OnlyFans malware: what it is and how to remove it from Windows
OnlyFans malware is a ZIP file, offered as free paid content, whose .vbs script installs the DcRAT remote access trojan on Windows. If you ran that script, change your passwords from another device and follow the removal steps.
Facts checked October 12, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If a .vbs file from a ZIP of "OnlyFans" photos, or an alert naming DcRAT keeps coming back after uninstalling, a scan can find what reinstalls it.
Do it yourself · free Remove OnlyFans malware (DcRAT) yourself 5 steps, about 15 minutes, no software needed.
Start the steps
OnlyFans malware (DcRAT): summary
| Type | Remote access trojan delivered by a VBScript loader in a ZIP with an adult-content lure (payload DcRAT, a free copy of AsyncRAT) |
|---|---|
| Risk | High: a person can watch the PC, record typing and take saved logins, cookies and Discord tokens; a ransomware plugin exists |
| Symptoms | Often none. A run .vbs file from a ZIP, a security alert, files renamed .DcRat or sign-in alerts can show it |
| How to get rid of it | Disconnect, change passwords from another device, Safe Mode, Windows Security full scan, Defender Offline, check startup and tasks, reset Windows if unsure |
| Our check (6 October 2026) | No PC test: we read eSentire, BleepingComputer, SpamTitan, Microsoft and vendor pages; we ran no sample |
| Running since / first seen | Samples from January 2023 (eSentire); reported 15 June 2023; our guide 23 June 2023 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 10 more facts
| Detection | Microsoft lists Trojan:Win32/DCRat.GVE!MTB, Backdoor:MSIL/DCRat!MTB and Trojan:Win32/AsyncRAT.A!MTB; the script is called VBS:Obfuscated-HZ [Cryp] by Avast and trojan.valyria/cryp on VirusTotal |
|---|---|
| Payload and host | DcRAT injected into RegAsm.exe under the .NET Framework folder |
| Not to be confused with | The commercial Dark Crystal RAT, fake OnlyFans dating sites and a hacked OnlyFans account |
| Name | OnlyFans malware |
| Evidence | 0 write-ups by security sites; details still limited |
| First seen | 23 June 2023 |
| Microsoft Defender name | Trojan:Win32/DCRat.GVE!MTB |
| Distribution | Typically e-mail attachments, fake installers, cracked games, tech support scams and compromised updates |
| Damage | Full remote control of the PC, theft of files and passwords, further infections |
| Facts checked | 6 October 2026 |
Facts checked on 6 October 2026 against eSentire's report of 15 June 2023, BleepingComputer's and SpamTitan's articles, Microsoft's pages for Safe Mode, Windows Security, Defender Offline, DISM and the System File Checker, and vendor excerpts for DcRAT.
We ran no sample and tested no PC; the removal steps were not tried on a live infection. Not confirmed: how the ZIP reaches people, how this chain restarts after a reboot, the text of the ransom note, any free decryptor, and whether the campaign is still active after June 2023.
What OnlyFans malware is, and what it is not
"OnlyFans malware" is not a virus inside OnlyFans. It is a ZIP file, offered as free paid content, that holds a script which installs a remote access trojan called DcRAT on Windows. The OnlyFans site and its creators are only the bait.
- 1
The bait
People who want paid OnlyFans photos or videos for free are offered a ZIP file named like a photo set of a known adult-film actress. eSentire's Threat Response Unit found the campaign in May 2023 at one of its customers, and says samples on VirusTotal go back to January 2023.
- 2
The file inside
The ZIP holds a VBScript file (a .vbs script). It does nothing until the person double-clicks it, and eSentire says the victim runs it by hand. BleepingComputer, reporting on eSentire's findings, says the script is a lightly changed and obfuscated copy of a printing script that Splunk had analysed in 2021.
- 3
What it installs
The script unpacks a loader in memory and injects DcRAT into RegAsm.exe, a genuine part of the .NET Framework. DcRAT is a free remote access tool, a copy of AsyncRAT with extra plugins, that lets a person watch the PC, record typing, take saved logins and Discord tokens, and run a ransomware plugin.
- 4
What it does not do
The reports we read do not describe any attack on OnlyFans accounts, on the OnlyFans site, or on creators. Nothing happens to a PC from visiting a genuine OnlyFans page. The danger starts when a file from somewhere else is run.
- 5
What our 2023 guide got wrong or left out
It said the campaign steals banking information and puts a PC in a botnet; the reports describe credential, cookie and Discord token theft, remote control and a ransomware plugin, and name no banking function. It also called the infection route unknown yet listed possible routes as if likely; eSentire says it could not tell how the ZIP reached its victim.
- Also called
- OnlyDcRatFans (eSentire's name for the campaign); DcRAT, a clone of AsyncRAT
- Found by
- eSentire Threat Response Unit, published 15 June 2023; reported by BleepingComputer on 19 June 2023
- Earliest known samples
- January 2023 on VirusTotal; newest sample seen by eSentire on 4 June 2023
- File you meet
- A ZIP with a .vbs script inside, named like an adult photo or video set
- Payload
- DcRAT, injected into RegAsm.exe under the .NET Framework folder
- Platform
- Windows only: the loader is a VBScript that uses Windows components
- Microsoft detection
- Trojan:Win32/DCRat.GVE!MTB and Backdoor:MSIL/DCRat!MTB are entries for DcRAT; which one fires depends on the build, and the script has other names
Does OnlyFans have viruses?
The OnlyFans website itself is not known to carry viruses, but fake OnlyFans content is a real malware lure.
This guide rests on eSentire, BleepingComputer and SpamTitan reports of a 2023 campaign in which a ZIP file sold as free OnlyFans pictures held a script that installed the DcRAT remote access trojan. None of those reports says the real site infects its visitors.
The danger sits in files and links offered outside the site. A ZIP that promises leaked or free paid content, sent in a message, a forum post or on a download page, may hold a .vbs script. Opening that script on Windows starts the infection. Pictures and videos watched on the official site or app are not the source of this attack in the reports we read.
To stay safe, use only the official site or app at an address you typed yourself, and never open a ZIP that claims to hold OnlyFans content. A real photo or video is not a script. If a download shows a file ending in .vbs, .exe, .scr or .js, do not run it. Windows Security can scan a file before you open it.
If you already opened such a file, treat the PC as infected. Disconnect it from the network, change your passwords from another device, then follow the removal steps earlier on this page. Our reading is that a plain visit to the website, without opening a download, does not call for this, though a quiet test never proves a PC is clean.
What OnlyFans malware (DcRAT) does on an infected PC
What we checked on 6 October 2026, and what we could not
There is no website to test and we did not run a sample. We read the eSentire report, BleepingComputer's and SpamTitan's articles, Microsoft's pages and vendor entries for DcRAT, and we ran nothing on a PC.
Our reading of the sources, 6 October 2026
- The campaign is documentedeSentire investigated a real case in May 2023 and published hashes of the loader, the payload and the shellcode. BleepingComputer and SpamTitan describe the same findings.
- The payload is a public tooleSentire says DcRAT's code is on GitHub, where its author archived it in February 2022 because of abuse.
- How the ZIP reaches peopleUnknown. eSentire could not see how its victim was served the file. Forums, chat messages, malicious ads and search-ranking sites are guesses in the press, not findings.
- Whether the campaign is still runningThe newest sample eSentire named was from 4 June 2023. We found no report of this exact chain after that, and we cannot say it has stopped; the same tools are reused by many groups.
- Steps on this pageThe removal steps follow Microsoft's pages and eSentire's description of the chain. We did not run them against a live infection.
- A clean scanDoes not clear a PC that ran the script. A remote access trojan lets a person act on it, and a scan that finds nothing says only that nothing matched on that one run.
Treat a run .vbs file from an "OnlyFans" ZIP as someone else being in control No test of ours can clear a PC. If you opened that script, assume saved logins, cookies and Discord sessions were readable, change your passwords from another device, and follow the removal chapter.
How the OnlyFans lure and DcRAT came together, 2021 to 2026
Our guide dates from 23 June 2023, a week after eSentire's report. The entries before it set the scene; those after it are new here.
October 2021
DcRAT dropped by another actor
BleepingComputer says a politically themed actor dropped DcRAT onto compromised systems along with other malware, one of the abuse cases that later led its author to archive the project.
December 2021
Splunk analyses the VBScript loader
Splunk described a script loader built from a Windows printing script, used then to deliver Remcos. The OnlyFans script is a lightly changed copy of it.
February 2022
The DcRAT author archives the code
eSentire says the author archived the GitHub repository, citing abuse. The code stayed public, so anyone can still build a copy.
January 2023
The first OnlyFans-themed samples
eSentire dates VirusTotal samples of this chain to January 2023. In the same month BleepingComputer saw a different scam, fake OnlyFans dating sites reached through an open redirect on a UK government site. It is not this malware.
May 2023
eSentire sees it at a customer
The company's Threat Response Unit found DcRAT at a consumer-services customer. Its endpoint protection blocked the script when the user ran it, and analysts isolated the system.
4 June 2023
The newest sample eSentire names
eSentire says new samples were still being submitted on 4 June 2023 and that they showed no significant change since January. A VirusTotal page for one such ZIP, of about 66 KB, is the picture at the top of this guide.
15 to 23 June 2023
The story spreads
eSentire publishes on 15 June, BleepingComputer on 19 June and SpamTitan on 21 June. Our guide follows on 23 June.
What users saw
The ZIP, the script and a blank file
Our 2023 guide pictured the three items on a desktop: the archive, the .vbs script extracted from it and a third, nameless file with a blank icon. We could not tie the third file to any source we read, so we do not explain it.
From our 2023 guide: the lure archive, the VBScript file taken out of it, and a third blank file. The names imitate a photo set. The woman is stock art, not a victim. October 2023
Microsoft announces the end of VBScript
Microsoft's list of deprecated features records the VBScript deprecation as announced in October 2023: it is to become a feature on demand before it is removed. Until it is switched off on your PC, a double-clicked .vbs file still runs.
2025
Another DCRat wave, another tool of the same name
Kaspersky's Securelist wrote about DCRat sold as malware-as-a-service and spread through fake game cheats. That is the commercial Dark Crystal RAT, a different program from the free one in the OnlyFans chain, although the names sound alike.
What happens when the script is opened
The steps below are eSentire's analysis of one loader. Other copies of the chain may differ in names and addresses.
- 1
You run the .vbs file
eSentire describes no window or message. The script is a Windows printing script that was modified to hold the loader. Its payload, a helper library called dynwrapx.dll and the shellcode are stored in the file as hex text, reversed and padded with junk characters, so a simple look at the file shows nothing readable.
- 2
It checks Windows and registers a helper
It asks Windows (WMI) whether the system is 32 or 64 bit and starts a 32-bit process if it needs one. It decodes dynwrapx.dll and registers it with regsvr32. That gives the script the DynamicWrapperX object, which lets a script call Windows functions it normally cannot.
- 3
It loads the payload into memory
Using CallWindowProcW from user32.dll and VirtualAlloc from kernel32.dll, it runs the shellcode, which places the DcRAT program inside RegAsm.exe in the Microsoft.NET Framework v4.0.30319 folder. Because the payload lives inside a real Microsoft program, security tools that judge by file name or path see less.
- 4
DcRAT calls home
The sample eSentire examined reported to the address 141.95.84[.]40. That address is a marker for this sample, not a list of every server used.
Not confirmed: eSentire does not say how this chain restarts after a reboot. Reports on the commercial Dark Crystal RAT list a scheduled task, a Run key and a Winlogon entry, and we cannot say the free DcRAT in this chain does the same. The check chapter looks at all three places for that reason.
What DcRAT can do on a PC
DcRAT is a copy of AsyncRAT with more plugins. Its functions come from what the person in control chooses to use, not from the OnlyFans script.
| Function | What it means for you | Where documented |
|---|---|---|
| Remote access | A person can see and control the PC from elsewhere | eSentire, BleepingComputer |
| Keylogging | Everything you type is recorded, passwords included | eSentire, BleepingComputer |
| Webcam monitoring | The camera can be watched; the light on the camera may or may not show | eSentire, BleepingComputer |
| File manipulation | Files can be browsed, copied out and changed | eSentire, BleepingComputer |
| Browser credential and cookie stealer | Saved logins and the cookies that keep you signed in can be read, which can open accounts without a password | eSentire, BleepingComputer |
| Discord token stealer | A copy of your Discord sign-in can be taken and used from another PC | eSentire, BleepingComputer |
| Ransomware plugin | Files can be encrypted and a note left asking for money (see the chapter on it) | eSentire, BleepingComputer |
Our 2023 guide called the payload a sophisticated weapon. The reports are less dramatic and more useful: it is a free tool, easy to get, that works because a person runs the script. eSentire's own conclusion is that free RATs are still capable tools for fraud, first access to a network or ransomware when paired with a loader that gets past defences.
What OnlyFans malware (DcRAT) can steal or download
The ransomware plugin: what it does
Encryption is something the person in control can switch on, not a first step of the OnlyFans chain. If your files have a new extension and a note, treat it as ransomware, not as an ordinary infection.
- What it encrypts
- Non-system files, says BleepingComputer on eSentire's findings
- New extension
.DcRatis added to each encrypted file name- The note
- An extortion note is left on the Desktop, listing the encrypted files, says eSentire. We did not find the text of the note in a source, so we print none and no payment address
- Decryptor
- Not confirmed: we did not find one for DcRAT's plugin. Do not pay
- What helps
- Backups you disconnected before the attack; identification of the family on ID Ransomware and No More Ransom, which can tell you if a free decryptor exists for it
Do not format or reset the PC until you have copied the encrypted files to a separate drive, in case a decryptor appears later. Then follow the removal chapter, because the remote access part is still on the PC.
What this malware can cost you
The risk is a person, not a program: whatever the controller decides to do with the PC. These are the documented functions turned into outcomes.
- High
Stolen accounts and logins
Keylogging, saved browser logins and cookies can give the controller your email, social media, work and shopping accounts. Treat them as exposed from the day the script was first run.
- High
A Discord account used in your name
A stolen Discord token lets someone use the account, read private chats and message your contacts, which can hurt your reputation and spread the scam to friends. Our 2023 guide made this point, and it stands.
- High
Your camera and files
Remote access, webcam monitoring and file access show and take what is on the PC. With an adult lure the files and camera can be the more sensitive part, and a person who is embarrassed may wait before asking for help.
- High
Encrypted files and a ransom demand
The ransomware plugin encrypts non-system files and leaves a note. Our 2023 guide said this could cause severe data loss; eSentire's notes agree and add that the tool has several ways to make money from one PC: file theft, credential theft and ransomware.
- Medium
Pressure to stay quiet
eSentire notes that adult lures make victims less likely to report the incident. That is exactly why they are used. If someone later writes to you with details from your PC, do not pay; tell your bank or the police as you would for any blackmail.
- Low
Money from a banking trojan
Our 2023 guide listed banking information and a botnet. The reports we read do not name a banking function or a botnet role for DcRAT here, so we do not claim them. Saved card details in a browser, though, are among what a credential stealer could read.
What you may notice, and why you often notice nothing
The loader shows no window of its own, and a remote access tool is built to run quietly. Our 2023 guide said symptoms can include losing access to files or accounts; that is what you see after the damage, not before.
| Sign | What we found |
|---|---|
| A ZIP or .vbs file you ran, named like a photo or video set | The clearest sign. Everything else on this list is secondary |
| A security alert naming DcRAT, AsyncRAT or a VBS or Script dropper | Microsoft lists Trojan:Win32/DCRat.GVE!MTB and Backdoor:MSIL/DCRat!MTB; other products use other names |
Files renamed with .DcRat and a note on the Desktop | The ransomware plugin has run |
| Sign-in alerts, password reset emails or Discord messages you did not send | Credentials, cookies or a Discord token may have been used |
| RegAsm.exe running in Task Manager for a long time | A process that normally runs briefly; the payload sits in it. This is our reasoning from eSentire's report, and legitimate software can start it too |
| The camera light on when you are not using it | Webcam monitoring is documented; the light itself is hardware dependent |
| Nothing at all | Common. The tool is made to be quiet, and a scan alone can miss an edited build |
How to check the PC for OnlyFans malware (DcRAT)
Where it leaves traces on a PC
These come from one sample that eSentire analysed. Other copies can use other names, so use them as places to look, not as a test that clears you.
- The lure
- A ZIP and a
.vbsfile with a name that imitates an adult photo or video set, usually in Downloads or on the Desktop - Loader file hash (MD5)
43876a44cc7736ff6432cb5d14c844fe(the VBScript in eSentire's case)- Payload hash (MD5)
9ea7ad97f219592366510d75fc945ea2(DcRAT); shellcode87fb8606f8fc38278112d5de9479f85c- ZIP hash in our 2023 guide
- SHA-256 beginning
0171614e4ba4ad75b0305dbb12072ef23a2e34946ffdfc81670224ffd89de75a, from BleepingComputer's VirusTotal link - Helper library
dynwrapx.dll, decoded by the script and registered with regsvr32- Host process
RegAsm.exeunderC:\Windows\Microsoft.NET\Framework\v4.0.30319(the path eSentire gives is the Framework folder; the 64-bit one is under Framework64)- Mutex
- A mutex containing
DCandRatMutexqwqdan3chun, seen in the decrypted DcRAT configuration - Command and control
141.95.84[.]40in the sample eSentire examined- Ransomware marker
- Encrypted files get the extension
.DcRat; a note is placed on the Desktop
Examples of names seen in reports
- RegAsm.exe
- dynwrapx.dll
- regsvr32
- DynamicWrapperX
- CallWindowProcW
- VirtualAlloc
- .DcRat
- RatMutexqwqdan3chun
- 141.95.84[.]40
- Backdoor:MSIL/DCRat!MTB
- trojan.valyria/cryp
- VBS:Obfuscated-HZ [Cryp]
The detection names in the last two chips come from the VirusTotal page in our 2023 guide, where Avast called the ZIP VBS:Obfuscated-HZ [Cryp] and the popular threat label read trojan.valyria/cryp. RegAsm.exe is a genuine Microsoft file: the folder it runs from and whether it is still running and connecting out are what matter, not its name.
OnlyFans malware detection names
If Windows Security shows Trojan:Win32/DCRat.GVE!MTB, it has found OnlyFans malware or a file that belongs to it.
Write the name down before you click Remove: it is the most useful search term later, and you will need it if you report the incident.
A family name in the label is more informative than a heuristic one. Our page on why one threat has many antivirus names lists the common formats and what each part means.
How the file reaches a PC
Nothing here infects a PC by itself: a person has to download the ZIP, take out the script and run it. How the ZIP is offered is the part nobody has shown.
- 1
The documented part
eSentire says victims were lured into downloading ZIP files holding a VBScript loader that they run by hand, and that the file names suggest explicit photos or OnlyFans content of adult-film actresses.
- 2
The undocumented part
eSentire could not see how its victim was served the ZIP. BleepingComputer lists malicious forum posts, instant messages, malvertising and search-ranking sites as possibilities. SpamTitan adds phishing emails, compromised social media accounts and text messages. None of these is shown for this campaign, so treat them as the usual routes for any lure, not as findings.
- 3
Why "free OnlyFans" is the hook
OnlyFans content is behind a paywall, and eSentire notes that adult lures lower the chance that a victim reports it. A real creator's content is only on the real site, behind a subscription. A ZIP offered elsewhere is never the genuine file.
- 4
What is not a route
Our 2023 guide listed infected email attachments, malvertising and cracked software together as if all were seen. Only the ZIP with the script is documented; the cracks are a general route for DcRAT's kind of tool, not part of this chain.
Not to be confused with
Several different things share the words OnlyFans, DcRAT or DCRat. Check which one you have before you follow a guide.
| Name | What it is | Link to this guide |
|---|---|---|
| DcRAT (this guide) | A free copy of AsyncRAT with extra plugins, code on GitHub, archived in February 2022 | The payload in the OnlyFans ZIP chain |
| Dark Crystal RAT, DCRat | A commercial RAT sold on dark-web forums and through a Telegram channel, per Malwarebytes; known since 2018, per Securelist | eSentire says the two are not to be confused; other articles mix them up |
| Fake OnlyFans dating or login sites | Scam websites that ask for payment or sign-in, reached for example through an open redirect, as BleepingComputer saw in January 2023 | A different campaign: no script, no payload |
| A hacked OnlyFans account | Someone has your OnlyFans or email password | Not malware on the PC; change passwords and turn on two-step sign-in |
| AsyncRAT | The open-source remote tool that DcRAT is based on | Antivirus may label DcRAT as AsyncRAT, says eSentire |
Check your PC before you clean it
Look first, delete later. Notes about the file and the startup entries are what a helper or your IT team will want.
- 1
Do not run the file again
If the ZIP or the .vbs file is still on the PC, leave it where it is and do not open it. The scan will quarantine it. Do not forward it to a friend to look at.
- 2
Write down the alert
If an antivirus named a detection, take a screenshot with its exact name, the file path and the time.
- 3
Open Task Manager
Press Ctrl + Shift + Esc, choose Details, and look for
RegAsm.exe,wscript.exeor any program you do not know. Right-click it and choose Open file location. A RegAsm.exe that keeps running, rather than finishing in seconds, is worth noting. - 4
Check startup apps
In Task Manager choose Startup apps and note entries you do not know.
- 5
Look at scheduled tasks
Press Windows logo + R, type
taskschd.mscand press Enter. Open Task Scheduler Library and look for tasks that start At log on with names you do not know. - 6
Look at the Run key, without changing it
Press Windows logo + R, type
regedit, openHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runand read the values. Note any that point to folders you do not recognise. Leave them until the scans are finished. - 7
Look at the connections
Open Command Prompt and run
netstat -ano. An ESTABLISHED line to an address you do not know is worth noting; then runtasklist /fi "PID eq 1234"with the number from the last column to see which program owns it. A clean list proves nothing: the controller may not be connected at that moment. - 8
Ask where it came from
A file from a chat, forum, ad or search result just before the first alert is the likely route. A PC at work is a case for your IT team, not for a clean-up on your own.
How to remove OnlyFans malware (DcRAT)
How to remove OnlyFans malware and lock the attacker out
Someone may have had remote control of the PC.
Cut the connection first, then remove the trojan and secure your accounts.
Step 1: Remove remote access tools and lock the attacker out
Unplug the network cable or turn off Wi-Fi first, so any remote session drops.
In Settings > Apps > Installed apps (Windows 11) or Apps & features (Windows 10), uninstall remote access programs you did not set up yourself, such as AnyDesk, ScreenConnect, TeamViewer or an unknown "support" tool.
Check Settings > Accounts > Other users (Family & other users in Windows 10) for accounts you did not create. Turn off Remote Desktop under Settings > System unless you use it.
Full procedure with screenshots: Uninstall a program or app in Windows On uGetFix
Step 2: Delete scheduled tasks that bring it back
Open Task Scheduler from the Start menu and click Task Scheduler Library. Select each task you do not recognise and read the Actions tab:
- a task that starts a file in
%AppData%or%Temp% - runs
powershellwith a long encoded line - opens a web address belongs to OnlyFans malware or a similar program
Right-click such a task and choose Delete, and check the subfolders too. Leave tasks from Microsoft, your PC's maker and programs you use. Task Scheduler is the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
- a task that starts a file in
Step 3: Remove it from startup
Whatever OnlyFans malware installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc, go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.
Open file location on the right-click menu shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.
Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 4: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Assume that the passwords saved in this PC's browsers, and the accounts that were open in them, are known to the attacker. From a phone or a clean computer, change the e-mail password first, then banking, shopping, social and gaming accounts.
Use each service's option to sign out of all other sessions, because stolen cookies keep a session open even after a password change. Turn on two-step verification on each account. Wait with the infected Windows 11 or Windows 10 PC until the scans are clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Remove OnlyFans malware from Windows 11 and Windows 10
Do the steps in order. We did not run them against a live infection; they follow Microsoft's pages and eSentire's description of the chain. Because a person may have been in control of the PC, the account steps in the next chapter are not optional.
- 1
Disconnect the PC from the network
Turn off Wi-Fi or unplug the cable. For a remote access trojan this cuts the controller off too. On a work network, call IT first so that other PCs can be checked.
- 2
Change your passwords from another device
Use a phone or another PC that has never been near the infected one. Change your email first, then banking, shopping, social and Discord, and turn on two-step sign-in. If the PC logged your keys, new passwords typed on it go to the controller.
- 3
Back up documents only
Copy documents and photos, not programs, to an external drive that you unplug afterwards. Programs and scripts can carry the infection.
- 4
Start in Safe Mode with Networking
Open Settings > System > Recovery, click Restart now beside Advanced startup, then choose Troubleshoot > Advanced options > Startup Settings > Restart and press 5 for Safe Mode with Networking. Our 2023 guide gave three ways in: Start > Power > Restart, pressing F8 at boot and the Settings route. Microsoft's page for Windows 11 and 10 does not mention F8, so we kept the Settings route and the number key 5.
- 5
Update the definitions and run a full scan
Open Windows Security > Virus & threat protection > Protection updates and choose Check for updates. Then go to Scan options, select Full scan and click Scan now. Follow what the scan finds; do not restore anything it quarantines. Our 2023 guide said a scan should find and isolate every malicious file. A scan finds what it knows, and an injected payload that lives only in memory is not a file to find, so the next step matters.
- 6
Run Microsoft Defender Offline
In the same Scan options choose Microsoft Defender Offline scan and Scan now. Microsoft says it runs from a trusted environment outside the normal Windows kernel, which helps against malware that tries to get past the Windows shell. Review the result under Protection history.
- 7
Check the traces again
Repeat the check chapter: Task Manager, Startup apps, Task Scheduler and the Run key. A leftover startup entry that points to a file that no longer exists can be removed; one that still points to a file you do not know is not clean.
- 8
Repair Windows only if it misbehaves
Our 2023 guide said malware can damage the registry, boot sections and DLL files. The reports on this chain describe none of that. If Windows crashes or features break, open Command Prompt as administrator and run
DISM.exe /Online /Cleanup-image /Restorehealth, thensfc /scannow, as Microsoft's page for corrupted system files describes. Wait for 100%. - 9
Update Windows and your programs
Open Settings > Windows Update and install everything offered, and update your browsers and Discord.
- 10
Reset Windows if you cannot be sure
A remote access trojan lets someone change many things. If the PC holds banking, work or private data, or the alert came back, back up documents and use Settings > System > Recovery > Reset this PC and choose Remove everything. Restore documents only, and scan them first.
Our 2023 guide said to let antivirus do the removal and to use a patented repair program afterwards. The built-in tools above do the same work without a download; do not buy a program because a pop-up or an article told you to. It also said that malware may switch off your antivirus. We found no report of this chain doing that, but if Windows Security will not open or will not update, treat that as a reason to use Safe Mode and the offline scan.
After removal: passwords, accounts and prevention
Accounts come next
Because the PC showed A .vbs file from a ZIP of "OnlyFans" photos, or an alert naming DcRAT in the list of installed apps, a sign of a program that could read browser data, the clean-up is only half of the work. The other half happens in your online accounts.
Change passwords from a clean device, beginning with e-mail; sign out of all sessions; check forwarding rules and recovery phone numbers; and turn on two-step verification with an authenticator app or a passkey. Ask your bank to replace cards saved in the browser.
Why the order matters and what to check in each account: secure your accounts after malware.
If you ran it: what to do about your accounts
The scans deal with the PC. These steps deal with what the controller may have seen, and they matter most if you ran the script.
- 1
Sign out everywhere
Use the sign out of all sessions option in your Google, Microsoft, social and work accounts so that stolen cookies stop working. Do the same for Discord and check which devices are signed in; the menu names in the Discord app change, and we did not check them.
- 2
Look at your email rules and recovery details
In your email account, check forwarding rules, the recovery email and the phone number, and the list of signed-in devices. Remove what you did not set.
- 3
Check your money
Look at card statements and any wallets for payments you did not make, and tell your bank if you saved card or banking details in a browser on that PC.
- 4
Look for ransomware
Check whether documents were renamed with
.DcRator a note appeared on the Desktop. If so, do not pay and do not reset the PC yet; the ransomware chapter says what to do. - 5
Tell the people who may be affected
If the PC is used for work, tell your employer. If your Discord was taken, warn the servers and friends who may get messages from it. You do not have to explain why you were on that page.
- 6
If someone contacts you with your own material
Do not pay and do not reply. Keep screenshots, report it to the platform it came through, and to the police or your national cybercrime service.
- 7
Scan again in a week
Run a full scan and a Microsoft Defender Offline scan again, and look at the startup entries once more.
Keep a remote access trojan off your PC
Our 2023 advice was to update, be careful with attachments, use antivirus and browse safely. It still holds; here it is with the lessons of this campaign.
Do
- Get paid content only from the creator's own page on the site that sells it. A free copy somewhere else is the bait.
- Keep Microsoft Defender or another security product with Real-time protection on, and keep it up to date. Scan downloaded archives before you open them.
- Install Windows Update monthly and update your browsers and Discord.
- Turn on Show file extensions in File Explorer (View > Show > File name extensions), so that a file named like a photo that really ends in .vbs gives itself away.
- Open an archive and look at what is inside before you run anything: scripts (.vbs, .js, .hta, .bat, .cmd) and programs (.exe, .scr) are not photos.
- On a work or family PC, an administrator can make script files open in Notepad instead of running, and can use Microsoft's Attack Surface Reduction rule that blocks JavaScript or VBScript from launching downloaded executable content, as eSentire advises.
- Use a password manager and two-step sign-in so one stolen password does not open every account.
- Keep a backup of documents on a disk you unplug (File History or OneDrive), so that you can reset Windows without losing them.
Don't
- Do not run a .vbs, .js or .exe from a ZIP that says it holds photos or videos.
- Do not trust a message, forum post or ad that promises free OnlyFans content.
- Do not use cracked programs or files from torrents, which are the same kind of risk.
- Do not run two antivirus programs with live protection at once.
- Do not add an exclusion for a file because a download page told you to; its maker must have confirmed that it is clean.
- Do not keep quiet because of what the lure was. The people who help with this have seen it many times.
Questions about OnlyFans malware (DcRAT)
What is OnlyFans malware?
OnlyFans malware is a ZIP file, offered as free paid content, that contains a script which installs a remote access trojan called DcRAT on Windows.
It is not a virus inside the OnlyFans site, and visiting the genuine site does not infect a PC. eSentire's Threat Response Unit found it in May 2023 at a customer and dated VirusTotal samples to January 2023.
The victim has to download the ZIP and run the .vbs script inside by hand. The file names suggest explicit photos or content of adult-film actresses. If you ran such a script, treat the PC as under someone else's control and follow the removal steps above.
Is the OnlyFans website itself infected?
No source we read says the OnlyFans site, its apps or its creators were infected or hacked in this campaign. OnlyFans is only the name used on the lure: the malware comes in a ZIP file from somewhere else, and paid content is not given away in archives. The risk starts when you run a file from outside the site.
A different scam in January 2023 used fake OnlyFans dating sites reached through an open redirect on a UK government site, as BleepingComputer reported. That is not this malware either. Content you pay for on the real site, in your browser or the official app, is not the problem.
What is DcRAT?
DcRAT is a free remote access tool for Windows, a modified copy of the open-source AsyncRAT with extra plugins. eSentire says its code is on GitHub, where the author archived it in February 2022 because of abuse. It records keystrokes, watches the webcam, handles files, steals browser logins and cookies, steals Discord tokens, and has a ransomware plugin.
Because most of the code matches AsyncRAT, antivirus may label it AsyncRAT. It is not the same as the commercial Dark Crystal RAT, sold on dark-web forums, although many articles use the names as if they were one.
How do I know if I ran it?
If you opened a .vbs file that came out of a ZIP of photos or videos, assume you ran it. The script shows nothing on screen, so the lack of a message proves little.
Signs that may follow are an antivirus alert, a RegAsm.exe that keeps running in Task Manager, sign-in alerts you did not cause, Discord messages you did not send, or files renamed with .DcRat and a note on the Desktop.
Run the check steps above, then the Windows Security full scan and the Defender Offline scan. A clean result does not clear the PC; it says only that nothing matched on that run.
How do I remove OnlyFans malware from Windows 11 or 10?
Disconnect the PC from the network, change your passwords from another device, start in Safe Mode with Networking, then run a Windows Security full scan and a Microsoft Defender Offline scan. Check Task Manager, startup apps, Task Scheduler and the Run key for entries you do not know.
If you cannot be sure the PC is clean, or it holds private data, back up your documents and use Reset this PC with Remove everything. Do not buy a cleaner because an article told you to. We have not tested these steps on a live infection; they follow Microsoft's pages and eSentire's report.
What can DcRAT steal from my computer?
DcRAT can record what you type, read passwords and cookies saved in web browsers, take Discord tokens, view the webcam, and copy or change files. The cookies matter because they can keep an account signed in, so a thief may get in without your password.
Our 2023 guide also listed banking information; the reports we read do not name a banking function, though card details saved in a browser could be among what a credential stealer reads. Change passwords from a clean device, sign out of all sessions and check your accounts and statements.
Can it encrypt my files like ransomware?
Yes, DcRAT has a ransomware plugin, but the person in control has to use it. eSentire and BleepingComputer say it encrypts non-system files, adds the .DcRat extension to their names and leaves an extortion note on the Desktop listing the files.
We found no free decryptor for it and did not find the text of the note, so we cannot confirm either. Do not pay, copy the encrypted files to a separate drive, and check the family on ID Ransomware and No More Ransom. Remove the remote access part as well, or the PC stays in someone else's hands.
Does it work on Mac, iPhone or Android?
The chain we found is built for Windows. It uses a VBScript file, WMI, regsvr32, Windows API calls and the .NET Framework's RegAsm.exe, none of which a Mac, iPhone or Android phone has. A ZIP opened on those systems does not run the script.
That does not make the lure safe: a ZIP that you copy to a Windows PC and run there does the damage, and other lures with the same bait can aim at other systems. If a Mac or phone holds the same saved logins, change those passwords as well.
I ran the file and I am embarrassed. Who should I tell?
Tell the people who can fix the damage, and do not let embarrassment stop you. eSentire notes that adult lures work partly because victims do not report them. Tell your IT team if the PC is a work PC, and tell your bank if card details were saved.
Change your passwords from a clean device and warn friends if your Discord was taken. If someone contacts you with your material, do not pay, keep the messages, and report it to the police. You do not have to describe what the file promised to anyone who is only helping with the PC.
Will Fortect remove OnlyFans malware?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For OnlyFans malware, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- eSentire: OnlyDcRatFans: Malware Distributed Using Explicit Lures of OnlyFans Pages and Other Adult Content (15 June 2023) (read October 6, 2026)
- BleepingComputer: Hackers use fake OnlyFans pics to drop info-stealing malware (19 June 2023) (read October 6, 2026)
- SpamTitan: Free OnlyFans Content Used as a Lure in DcRAT Malware Campaign (21 June 2023) (read October 6, 2026)
- Splunk: Dark Crystal RAT Agent Deep Dive (search-result excerpt; about the commercial Dark Crystal RAT) (read October 6, 2026)
- Kaspersky Securelist: New wave of attacks on gamers with DCRat backdoor (search-result excerpt) (read October 6, 2026)
- Malwarebytes: Backdoor.DCRat (search-result excerpt) (read October 6, 2026)
- Microsoft Security Intelligence: Trojan:Win32/DCRat.GVE!MTB (title only, search result) (read October 6, 2026)
- Microsoft Security Intelligence: Trojan:Win32/AsyncRAT.A!MTB (title only, search result) (read October 6, 2026)
- Microsoft Security Intelligence: Backdoor:MSIL/DCRat!MTB (title and search-result excerpt only) (read October 6, 2026)
- Microsoft Learn: Deprecated features in the Windows client (VBScript, announced October 2023) (read October 6, 2026)
- Microsoft Support: Windows startup settings (Safe Mode) (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline scan in Windows (read October 6, 2026)
- Microsoft Support: Use the System File Checker tool to repair missing or corrupted system files (read October 6, 2026)
- PCrisk: OnlyFans malware removal guide (read October 6, 2026)