Remote Access Signs: Most Likely It's RDP or a Stolen Session

1. RDP Left Open to the Internet — Most Common Culprit

Had a client last month — a small dental office — whose mouse started clicking around 3 AM. They thought it was a ghost. Turns out their IT guy had opened port 3389 on the firewall so he could remote in from home. Forgot to close it. A bot in China found it in under 12 hours.

If you see the mouse move, windows open, or files get copied without you touching anything, odds are someone's connected via Remote Desktop Protocol (RDP). Here's the fix.

Step 1: Kill the session immediately

1. Hit Ctrl+Alt+Del and select Task Manager.
2. Go to the Users tab. You'll see your account and maybe a second one like "admin" or "remotely."
3. Right-click the other user and choose Disconnect. Not "Sign Out" — that might leave processes running. Disconnect boots them out clean.

If you don't see a Users tab (happens on older Windows 10 builds), go to the Details tab, find mstsc.exe, right-click, and End Task. That kills the RDP listener.

Step 2: Block the port on your router

RDP uses port 3389. If you forwarded that port, undo it. Log into your router (usually 192.168.1.1 or 192.168.0.1), find Port Forwarding, and delete the rule for TCP 3389. If you don't know how, Google your router model + "disable port forwarding."

Windows Firewall: netsh advfirewall firewall add rule name="Block RDP" dir=in action=block protocol=TCP localport=3389

Run that command as Admin. It won't close your RDP listener, but it blocks incoming connections from the network. Good quick-shield till you fix the router.

Step 3: Disable RDP altogether (unless you really need it)

Go to Settings > System > Remote Desktop and toggle Enable Remote Desktop to Off. If you need it, at least turn on Network Level Authentication — that blocks older, weaker clients.

2. Stolen Session Token or Browser Hijack

Second most common scenario: you're logged into a web app (Google, Facebook, your bank), and someone grabs your session cookie. They don't need your password. They just copy that cookie and connect from their machine. You see tabs opening, searches happening, maybe even changes to settings.

This happened to a buddy of mine running a Shopify store. He saw products being deleted at 2 AM. He thought it was a disgruntled employee. Nope — someone stole his admin session token from a public Wi-Fi.

Step 1: Sign out everywhere

1. Go to your Google Account: myaccount.google.com/device-activity
2. Click Manage all devices, then Sign out all. Do the same for Facebook, Microsoft, any site you care about.
3. Clear browser cookies: Ctrl+Shift+Del, select Cookies and other site data, time range All time.

Step 2: Check for browser extensions doing dirty work

Chrome: chrome://extensions. Edge: edge://extensions. Look for anything you didn't install — especially ones with permissions like "Read and change all your data on websites." Remove them. I've seen fake ad-blockers that exfiltrate session tokens in real time.

Step 3: Rotate passwords, but do it from a clean device

Use your phone or a different computer to change passwords for email, banking, social media. If the attacker still has a token, changing password on the compromised machine just hands them the new one.

3. Backdoor Admin Account or RAT (Remote Access Trojan)

The scariest one, but rarer. Someone planted a hidden admin account or a RAT like njRat, DarkComet, or Quasar. You'll see random command prompt windows flash, files appear in C:\Users\Public, or antivirus alerts you didn't trigger.

Step 1: Check for hidden user accounts

1. Open Command Prompt as Admin.
2. Run: net user
3. Look for accounts you don't recognize. Attackers often name them something bland like "HelpAssistant" or "Admin2".
4. Remove them: net user [username] /delete

Step 2: Scan for RATs

Windows Defender is decent for this. Run a full offline scan: Settings > Update & Security > Windows Security > Virus & Threat Protection > Scan Options > Microsoft Defender Offline Scan. It reboots and checks before Windows loads.

But I'll be honest — if you find a RAT, the safest move is to wipe the drive and reinstall Windows. RATs often hook deep into the system. A scan might miss persistence mechanisms in the registry, scheduled tasks, or boot loader.

Check scheduled tasks: taskschd.msc /s
Look for tasks with weird names like "JavaUpdate", "AdobeFlash", "ServiceHost" that run as SYSTEM.

Step 3: Lock down local admin rights

If the attacker got admin access, they probably came through a weak local admin password. Change the built-in Administrator password: net user administrator [newstrongpassword]. Also disable Guest account: net user guest /active:no.