gitrm.sbs: a server handing out PowerShell scripts and files tagged RedHiveStealer, and what to do if a PC ran them
gitrm.sbs is a web address that URLhaus lists four times in two days (17 and 18 October 2026) for a PowerShell script, a password tagged zip file and a file called 7za.exe, with the home page itself tagged RedHiveStealer.
It is not a program on your PC: it is a server, and the risk is for a Windows PC where someone or something ran a command that fetched from it. If you only saw the name in a log, nothing is proven; if a PC may have run it, change your passwords from another device, then scan and clean or reset Windows.
Facts checked October 18, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If a PowerShell command, script or program that downloads files from gitrm.sbs keeps coming back after uninstalling, a scan can find what reinstalls it.
Do it yourself · free Remove gitrm.sbs (RedHiveStealer, PowerShell loader) yourself 5 steps, about 15 minutes, no software needed.
Start the steps
Gitrm.sbs (RedHiveStealer, PowerShell loader): summary
| Type | A malware server: URLhaus lists a PowerShell script, a password tagged zip and 7za.exe, and tags the home page RedHiveStealer |
|---|---|
| Risk | High if a PC ran a command or file from it: saved logins and sessions may be taken. Low if you only saw the name |
| Symptoms | Often none. A flashing PowerShell window, unknown files such as 2.zip or 7za.exe, unknown scheduled tasks, or logins from new places |
| How to get rid of it | Change passwords from another device, run Microsoft Defender Offline, remove startup entries you can tie to it, and reset Windows if you are not sure |
| Our check (18 October 2026) | One plain request from our server: HTTP 200, no title, nginx. A quiet answer clears nothing; the danger rating comes from URLhaus |
| Running since / first seen | Domain registered 11 September 2026; first report 17 October 2026 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 9 more facts
| Platform | Windows. Nothing we read says Mac or phones are affected |
|---|---|
| Detection names | No Microsoft detection name is known for the files on this server, because we did not open them |
| Name | Gitrm.sbs |
| Domain registered | 11 September 2026 |
| Evidence | 4 write-ups by security sites; details still limited |
| First seen | 17 October 2026 |
| Distribution | Typically fake installers, cracked programs, e-mail attachments, fake "verify you are human" pages and ads for popular apps |
| Damage | Installs other malware, often several programs at once |
| Facts checked | 18 October 2026 |
Facts checked on 18 October 2026 against the URLhaus data for gitrm.sbs held in our database (the abuse.ch host page itself was not fetched by our tool), RDAP, one plain request from our server, and pages by Microsoft Learn, the FTC, BleepingComputer and SentinelOne.
We found no published analysis of RedHiveStealer. We did not download the files and we infected no PC; the removal steps follow Microsoft and FTC pages and were not tried on a live infection.
What gitrm.sbs is, and what we know about it
gitrm.sbs is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists as a place where malware was served. We found no public write up of this address or of the name RedHiveStealer, so what follows is what URLhaus shows, what our server saw, and what vendors have published about the technique the tags point to.
- 1
What URLhaus lists
Four addresses on gitrm.sbs. The home page was added on 17 October 2026 at about 16:24 UTC by a reporter called ffforward. On 18 October three more followed from a reporter called NDA0E: apix.ps1 at about 12:40 UTC, assets/2.zip at about 13:03 and assets/7za.exe at about 13:04. All four carry the threat label malware_download. At the time of our data, three were online and apix.ps1 was offline.
- 2
What the tags mean
The home page is tagged powershell, ps1, iex-irm, mops_to and RedHiveStealer. ps1 is the ending of a PowerShell script. iex-irm most likely names the common one line pattern in which Invoke-RestMethod (irm) downloads text and Invoke-Expression (iex) runs it at once; that is our reading of the tag. RedHiveStealer is the name the reporter gave the malware. We could not find out what mops_to means. The zip carries the tags zip and pw-1523, which may be the password of the archive (our reading). The exe file carries only the tag exe.
- 3
What we could not confirm
We did not download any file, so we cannot tell you what is inside the script, the zip or the program. We found no vendor report, sandbox page or write up that names RedHiveStealer in a way we could read, so we cannot list what it takes or where it sends it. URLhaus shows tags that a reporter chose, not a proof.
- 4
What this means for you
If you only saw the name in a firewall log, a blocked request or a warning, you are not infected by that alone. A person does not normally type this address into a browser. The risk is for a PC where a command, a script or a program already ran and went to fetch from it.
- Kind of threat
- A server that hands out a PowerShell script, a zip and an exe; the home page is tagged RedHiveStealer, an information stealer by its name
- Where the files are
- hxxps://gitrm[.]sbs/ (home page), hxxps://gitrm[.]sbs/apix[.]ps1, hxxps://gitrm[.]sbs/assets/2[.]zip and hxxps://gitrm[.]sbs/assets/7za[.]exe
- Domain registered
- 11 September 2026, registrar Global Domain Group LLC; transfer prohibited statuses are set (RDAP, read 17 October 2026)
- URLhaus entries
- 4 addresses, added 17 and 18 October 2026; 3 online and 1 offline in our copy of the data
- Delivery trick
- A PowerShell one liner that downloads and runs text from the server (tag iex-irm). How a victim is made to run it is not known
- Platform
- Windows, because PowerShell scripts and an exe are the files. Nothing we read says Mac, iPhone or Android are affected
What gitrm.sbs (RedHiveStealer, PowerShell loader) does on an infected PC
What we checked on 18 October 2026, and what we could not
Our check was one plain request from our server to https://gitrm.sbs/. It was not a browser, there were no clicks, and no file was downloaded. The server answered with HTTP status 200. That clears nothing.
Our request, 18 October 2026
- The home page answeredHTTP 200, no redirect, no page title, server header nginx/1.24.0 (Ubuntu). A page with no title is a bare response, often a text or script rather than a normal website. We did not read the body, and URLhaus tags the home page as a PowerShell script source.
- Why a quiet answer is not a clean resultServers like this can answer differently by program, country or request headers. A plain request from our server may get something other than a PowerShell client would get.
- Notification requestNone seen on this one request. The response did not mention the browser notification interface.
- URLhaus listingFour addresses reported on 17 and 18 October 2026, three online, home page tagged RedHiveStealer and iex-irm.
- Downloads and the files themselvesWe did not download the script, the zip or the exe. We cannot tell you what they contain.
Dangerous: treat it as a malware server Our check was a single plain request, so it proves nothing either way. The danger rating comes from the four URLhaus reports and their tags, not from our request. Do not request files from this address and do not run anything that does.
What happened to gitrm.sbs, from registration to our check
The domain is about five weeks old and the reports are all from the last two days. The dates come from RDAP and from the URLhaus data we hold; times are UTC.
11 September 2026
The domain is registered
RDAP shows gitrm.sbs registered on 11 September 2026 at about 01:01 UTC through Global Domain Group LLC. The status list says transfers are prohibited, which is a normal lock and says nothing about the owner.
17 October 2026
The home page is reported
At about 16:24 UTC the home page is added with the tags powershell, ps1, iex-irm, mops_to and RedHiveStealer. It is marked online.
18 October 2026, morning
apix.ps1 is reported
At about 12:40 UTC a second reporter adds hxxps://gitrm[.]sbs/apix[.]ps1 with the tag ps1. It is already marked offline in our data.
18 October 2026, afternoon
A zip and an exe are reported
At about 13:03 UTC assets/2.zip is added (tags zip, pw-1523) and a minute later assets/7za.exe (tag exe). Both are online. Our own request to the home page the same day returns status 200.
The four URLhaus reports for gitrm.sbs as held by 2-Spyware on 18 October 2026.
What the pattern suggests, and what it does not: a script, then an archive, then a tool to open it, all within a day, looks like an operator preparing a delivery chain. That is our reading of the dates and file names. No report says it, and it does not tell us how many PCs ran the chain.
How a PowerShell one liner, a zip and 7za.exe fit together
We did not open the files, so this is how the tags and file names fit a chain that vendors have described, not a description of this server. Microsoft's research on a related ClickFix variant, reported by BleepingComputer on 31 August 2026, shows the same shape.
- 1
A command is run on the PC
In ClickFix style attacks a fake verification page tells the visitor to paste a copied command into Windows Run, PowerShell or Windows Terminal. BleepingComputer, reporting on Microsoft, describes fake Cloudflare CAPTCHA prompts on hacked websites that put a PowerShell command on the clipboard. Whether gitrm.sbs is reached that way is not known.
- 2
The script is downloaded and run
A pattern with irm and iex downloads text and runs it without saving a file, so a file scan on disk may see nothing at that moment. The tag iex-irm on the home page fits this. The command line is the visible trace.
- 3
A password zip and an unpacking tool
7za.exe is the name of the stand alone console version of the 7-Zip archiver. A script that fetches a password protected zip and a program with that name would have what it needs to unpack the archive. This is our reading. We did not check whether the exe on this server is the real 7-Zip or something else with that name.
- 4
A signed program and a loader
In the Microsoft case the zip held a genuine signed executable and a malicious DLL that decoded and launched a payload directly in memory, and later stages were hidden in the pixel data of PNG pictures. Whether the zip on gitrm.sbs works this way is not known.
- 5
The stealer runs
The home page tag names RedHiveStealer. From then on, the person behind it may collect what the program is built to collect. No source we could read lists that for this name, so the next sections use what stealers of this kind are known to take as a precaution.
What RedHiveStealer is, and what is not known
We searched for RedHiveStealer and found no vendor report, no Microsoft detection name and no sandbox page for it. We therefore do not describe a family. The name is the tag a reporter put on the home page.
| Question | What we know | Source |
|---|---|---|
| What is it? | A name used as a tag on the home page. By the word stealer it points to a program that takes data from a PC | URLhaus data |
| Is there a published analysis? | None we could find on 18 October 2026 | Our search |
| What does it take? | Not confirmed. Stealers delivered through ClickFix style chains are reported by SentinelOne to include LummaStealer and NetSupport RAT as final payloads; that is a different family and not proof for this one | SentinelOne |
| Microsoft detection name | None known to us. We did not open the files | Not available |
| Does it stay after a restart? | Not known. In the Microsoft case a scheduled task and a registry Run key started the malware hourly; this is another campaign | BleepingComputer on Microsoft |
| Is it real malware or a test? | We cannot tell. The domain is five weeks old and was reported by two different people, which fits real use, but we did not open anything | Our reading |
What gitrm.sbs (RedHiveStealer, PowerShell loader) can steal or download
What a stealer can take from a Windows PC
The list below is what information stealers are generally built to collect, taken from what the sources describe for ClickFix delivered stealers. It is a precaution for a PC that ran the chain, not a list for RedHiveStealer.
Possible, not confirmed for this name
- Passwords saved in the browser
- Cookies and logged in sessions
- Cryptocurrency wallet files
- Documents and files
- Autofill and card data
- A list of installed programs
- Extra malware downloaded
A remote access tool such as NetSupport RAT, named by SentinelOne among the final payloads of ClickFix campaigns, gives a person live control. We have no evidence that gitrm.sbs delivers one.
What this can cost you
Reading the site or seeing its name costs nothing. The risks below apply to a Windows PC that ran a command or a file from this server.
- High
Passwords and accounts
A stealer takes saved logins and session cookies. A stolen session can open an account without the password. Changing passwords on the infected PC does not help, because new ones can be seen too.
- High
Crypto and banking
Wallet files and seed phrases that were on the PC may be copied. Crypto sent from a stolen wallet cannot be reversed.
- Medium
Your files
Documents on the PC may be looked through and copied. We cannot say how far a given build goes.
- Medium
More malware on the same PC
A loader chain can fetch further programs. In the Microsoft case it set a scheduled task and a Run key and probed the network for other machines.
- Low
Nothing, if you only saw the name
A name in a block list, a log or a warning is not an infection.
What you may notice, and what you may not
Stealers are built to be quiet and to finish fast. The signs below are what the sources suggest; none is certain, and many victims notice nothing until an account is used.
| Sign | What the reports show |
|---|---|
| A PowerShell window that flashed and closed | A one liner that downloads and runs text shows briefly. This is our reading of the iex-irm tag |
| A zip, a 7za.exe or a strange folder in Downloads, Temp or ProgramData | A chain with a password zip and an unpacking tool leaves files behind unless it cleans up |
| A scheduled task or startup entry you did not make | Microsoft's related campaign used a scheduled task and a Run key, so check them. This is another campaign |
| Logins from new places or password reset mails | These follow from stolen logins or session cookies |
| Nothing at all | Quiet running is the aim of this kind of malware |
How to check the PC for gitrm.sbs (RedHiveStealer, PowerShell loader)
How a person ends up running something from this address
Nobody visits gitrm.sbs on purpose. The request comes from a command or a program, so the real question is how it got onto the PC. We cannot say for this server; the routes below are the ones vendors found for similar chains.
- 1
A fake verification page
SentinelOne describes victims who are talked into solving a fake challenge, which leads to a PowerShell command and further payloads. Microsoft's related campaign used fake Cloudflare prompts on compromised sites. If a web page ever told you to press Windows key and R, paste something and press Enter, that is this route.
- 2
A command from a tutorial, a chat or a message
A one line command to install a tool or fix an error can be a download and run line. If someone sent you one that mentions an address you do not know, treat it as an attack.
- 3
A script or program already on the PC
The first program may have come from a cracked download or an attachment, and the address is then only the second stage. We have no evidence for which route applies here.
Check your PC before you delete anything
Start with the question that matters: did something on this PC contact gitrm.sbs, or did you paste a command from a web page or a message? If you saw the name in a firewall or DNS log, the device that asked is the one to check. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.
While you check, stop using the PC for banking, email, work or crypto, and disconnect it from all networks if you can.
- 1
Disconnect first
Turn off Wi-Fi or unplug the network cable. A stealer needs the connection to send data out.
- 2
Find which device asked for the address
If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question, not every device on the network.
- 3
Look at what PowerShell ran
Open File Explorer and paste %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine into the address bar. We did not find a Microsoft page for this path, so treat it as a common location rather than a promise. A file called ConsoleHost_history.txt lists commands typed in PowerShell on this account. Look for lines that mention an address you do not know. If the file is missing or has no such line, that clears nothing, because a command can be run from the Run box.
- 4
Open Task Scheduler
Press Start, type Task Scheduler and open it. Look in Task Scheduler Library for tasks you do not know, with random names, or that run a script or a program from a user folder. Write down the name and the program it runs, and do not delete yet.
- 5
Look at Startup apps
Open Settings > Apps > Startup and look for names you did not install. Entries here start with your Windows sign in.
- 6
Look for the files
Search Downloads, Temp and ProgramData for a file called 2.zip, 7za.exe or apix.ps1. Finding one is a strong sign; not finding one clears nothing, because chains often clean up.
- 7
Open Protection history
In Windows Security > Virus & threat protection > Protection history, look for anything blocked or quarantined around the time of the first contact. Microsoft says the results of an offline scan also appear there.
- 8
Check your accounts from another device
Look at the sign in activity of your email, bank and exchange accounts, and at crypto balances. This is quicker than any file check.
- 9
A scan helps, but it does not clear the PC
A scan with Microsoft Defender or another product can find known files. Treat a clean result the way you treat a clean site test: one data point. We did not infect a PC and no vendor publishes a removal procedure for this server, so the order of the plan is our judgement from Microsoft and FTC pages, not a tested result.
How to remove gitrm.sbs (RedHiveStealer, PowerShell loader)
How to remove gitrm.sbs
A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.
Step 1: Delete scheduled tasks that bring it back
Open Task Scheduler from the Start menu and click Task Scheduler Library. Select each task you do not recognise and read the Actions tab:
- a task that starts a file in
%AppData%or%Temp% - runs
powershellwith a long encoded line - opens a web address belongs to gitrm.sbs or a similar program
Right-click such a task and choose Delete, and check the subfolders too. Leave tasks from Microsoft, your PC's maker and programs you use. Task Scheduler is the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
- a task that starts a file in
Step 2: Remove it from startup
Whatever gitrm.sbs installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc, go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.
Open file location on the right-click menu shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.
Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items), and go through
%LocalAppData%,%AppData%, %ProgramData% and the two Program Files folders.Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold
.exe,.dll, .js or .ps1 files are the strongest sign.Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Assume that the passwords saved in this PC's browsers, and the accounts that were open in them, are known to the attacker. From a phone or a clean computer, change the e-mail password first, then banking, shopping, social and gaming accounts.
Use each service's option to sign out of all other sessions, because stolen cookies keep a session open even after a password change. Turn on two-step verification on each account. Wait with the infected Windows 11 or Windows 10 PC until the scans are clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
If you use a Mac, an iPhone or an Android phone
The tags describe Windows files: a PowerShell script and an exe. We found nothing that says this server affects anything else.
| Your device | What we know | What to do |
|---|---|---|
| Mac | The reported files are a PowerShell script, a zip and a Windows exe. We did not open them | Nothing known to remove for this threat. Do not follow the Windows steps on a Mac |
| iPhone or iPad | No source describes this server on iOS | Nothing to remove. If you typed passwords on a page that sent you here, change them |
| Android | No source mentions it | Nothing to remove for this threat; change passwords if you entered any |
After removal: passwords, accounts and prevention
After a clean PC: protect what was taken
The PC is one half. The other half is everything you typed or stored on it while the stealer may have been there. The order matters: another device first, then the PC.
- 1
Change passwords from a clean device
Use a phone or another computer that never ran the command. Start with email, because it resets everything else, then bank, work, cloud storage and crypto. The FTC says to make each password unique and long, 12 to 15 characters or a passphrase.
- 2
Sign out of every device and turn on two step sign in
The FTC says to sign out of the account on all devices so anyone else logged in is removed, and to turn on two factor authentication where offered. This matters because a stealer can take session cookies. Update the recovery email and phone number while you are there.
- 3
Look for traces in the accounts
The FTC suggests checking your email for forwarding rules you did not create and your social accounts for messages or posts you did not send.
- 4
Move crypto first if a wallet was on the PC
If a seed phrase or wallet file was ever on the PC, assume it is known. Create a new wallet and recovery phrase on a clean device and move the funds there.
- 5
Run Microsoft Defender Offline
Microsoft says to open Windows Security > Virus & threat protection > Scan options, choose Microsoft Defender Offline scan and select Scan now. Save your work first: Windows signs you out and restarts, and the scan takes about 15 minutes. If BitLocker is on, Microsoft says to suspend it first or the restart may ask for the recovery key. Results are under Protection history. Microsoft also notes the scan does not run if the Windows Recovery Environment is disabled, and gives the command reagentc /info to check it.
- 6
Remove startup entries you can tie to the chain
If Task Scheduler or Startup apps showed an entry that runs a script or program from a user folder and you can tie it to the files above, switch it off or delete it. If you cannot tell, do not guess: the safe answer is the reset below.
- 7
If you are not sure, reset Windows
Open Settings > System > Recovery > Reset this PC and choose Remove everything. For a PC that may have run a stealer, the full wipe is the answer that does not depend on finding every piece. Back up documents first and restore only documents and photos by hand, not programs and not a system image made after the first contact. This step is our advice from the wording of Microsoft's recovery page, which we did not re-read for this guide.
- 8
Rebuild logins in a password manager
Do not let the browser save passwords again on a PC that was watched. Use a password manager and an authenticator app or a security key for two step sign in.
- 9
Watch your money and report identity theft
Check card statements and exchange logs for several weeks and turn on alerts. The FTC says that if you think someone stole your personal information you can report it at IdentityTheft.gov to get a personal recovery plan.
- 10
If this is a work PC
Tell your IT team at once. Microsoft's advice on the related campaign is to investigate for movement to other machines and to rotate credentials, including admin credentials the PC could reach.
Keep a PC out of this kind of chain
The stealer is the last part of the chain. The part you control is the first: a command you paste or a file you run.
Do
- Close any web page that tells you to press Windows key and R, or open PowerShell, and paste something to prove you are human. Real verification never asks for that.
- Read a command before you run it. If it contains irm, iex, Invoke-Expression or an address you do not know, do not run it.
- Keep Windows and Microsoft Defender updated so the offline scan uses current definitions.
- Get programs from their makers' own sites or from the Microsoft Store.
- Use a password manager and two step sign in, so one stolen password is not enough.
- Keep a backup of documents on a disk that you unplug.
Don't
- Do not run a one line command from a chat, a video or a forum without understanding it.
- Do not run cracked programs or bundles from sites that promise free versions of paid software.
- Do not unpack a password protected zip that came from a stranger.
- Do not change your passwords on the PC you suspect.
- Do not rely on a quiet scan to say that you are safe.
Questions about gitrm.sbs (RedHiveStealer, PowerShell loader)
What is gitrm.sbs?
It is a web address that URLhaus, the malware tracking project run by abuse.ch, lists four times on 17 and 18 October 2026. The reports cover the home page, a PowerShell script called apix.ps1, a zip called 2.zip and a file called 7za.exe.
The home page is tagged RedHiveStealer. It is not a program on your PC and not a site anyone is meant to visit. We did not download the files, so what they contain is not confirmed by us.
Is gitrm.sbs safe to open?
No. Do not request files from it, and do not run any command that does. Our own check was a single plain request from our server, which got HTTP status 200 and no page title. That proves nothing, because servers like this can answer differently depending on who asks.
The rating comes from the four URLhaus reports and their tags, three of which were online in our data. If you already opened the home page in a browser and nothing else, a PowerShell script is not run by that alone, but you should still stay careful.
What is RedHiveStealer?
It is the name a reporter put on the gitrm.sbs home page in URLhaus. By its name it is an information stealer, a program that takes data such as saved logins from a PC.
We searched for it on 18 October 2026 and found no vendor report, no sandbox page and no Microsoft detection name, so we cannot tell you what it takes, how it hides or where it sends data. We do not guess; the precautions on this page are the ones that fit any stealer.
What does iex-irm mean in the URLhaus tags?
It most likely points to a common PowerShell pattern: Invoke-RestMethod (irm) downloads text from an address and Invoke-Expression (iex) runs that text straight away, without saving a file first. That is our reading of the tag, since we did not open the script.
It matters because a file scan of the disk may see nothing at that moment, and because the command line is the only visible trace. A legitimate installer sometimes uses the same pattern, so the tag alone does not prove harm.
I saw gitrm.sbs in my firewall or DNS log. Am I infected?
Not necessarily, and the name alone proves nothing. It does mean that a device on your network asked for it, and a person does not usually do that by hand. Find which device it was, disconnect it, and run the checks on this page:
- the PowerShell history file
- Task Scheduler
- Startup apps
- Protection history
- a Microsoft Defender Offline scan
Do the account changes from another device, not from the one you suspect.
How do I remove it from Windows?
Change your passwords from another device first. Then run a Microsoft Defender Offline scan (Windows Security, Virus and threat protection, Scan options), check Task Scheduler and Startup apps for entries you did not make, and remove the ones you can tie to the files.
If you are not sure, reset Windows with Remove everything and restore only documents. We followed Microsoft and FTC pages for this and did not test the steps on an infected PC.
What can a stealer see and take?
For RedHiveStealer itself this is not confirmed. Information stealers in general are built to take passwords saved in the browser, session cookies, cryptocurrency wallet files and documents.
SentinelOne reports that the fake verification attacks of this kind end in stealers such as LummaStealer or in the remote tool NetSupport RAT. Treat every password, every logged in session and every wallet on the PC as known, and change them from another device.
Does gitrm.sbs affect Mac, iPhone or Android?
We found nothing that says so. The reported files are a PowerShell script, a zip and a Windows exe, and the chain the tags suggest runs on Windows.
On a Mac, iPhone or Android phone there is nothing known to remove for this threat. If you typed a password on a suspicious page that led you here, change it from a device you trust and turn on two step sign in.
Will resetting Windows remove it, and are my accounts safe afterwards?
A reset with Remove everything wipes programs, scheduled tasks and startup entries, which is the answer that does not depend on finding every piece. It does not undo what was already taken.
Passwords, session logins and crypto seed phrases that a stealer saw stay exposed until you change them, from another device, and sign out of all sessions. Restore documents by hand, not a full system image made after the first contact.
Will Fortect remove gitrm.sbs?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For gitrm.sbs, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- BleepingComputer: Microsoft warns of TerminalFix attacks deploying reverse tunnels (31 August 2026) (read October 18, 2026)
- SentinelOne: Caught in the CAPTCHA, how ClickFix delivers RATs and infostealers (read October 18, 2026)
- Microsoft Learn: Microsoft Defender Offline scan in Windows (updated 25 August 2026) (read October 18, 2026)
- FTC: Email or social media hacked? Here's what to do (read October 18, 2026)
- abuse.ch URLhaus: host gitrm.sbs (rows held by 2-Spyware, page itself not fetched) (read October 18, 2026)