MacBook Pro contained message that computer was shut down due to hacking

calgel wrote:

When my husband opened our MacBook Pro this morning, it said “You’ve been hacked”, and your computer has been shut down. Call this number. Then, he did, and whoever answered said they were Apple Security. It was then supposedly sent over to Wells Fargo. I could go on with more details, but Wells Fargo says this is a common hack.

There is no Apple Security taking your call.

Husband withdrew a substantial amount of $s and put it into a bitcoin machine at the direction of “Wells Fargo”.

This is a a common scam not a hack, you played into the hands of the *** game and your money is gone.

You can call law enforcement to report the crime.

*Uninstall all third party apps that are Cleaners/Optimizers/Anti-Virus/VPN

Recognize and avoid phishing messages, phony support calls

Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Apple Support

Block pop-up ads and windows in Safari

Block pop-up ads and windows in Safari - Apple Support

Stop unwanted Notifications - John Galt

Stop unwanted Notifications - Apple Community

Protecting against malware in macOS

Protecting against malware in macOS - Apple Support

*Third party AntiVirus is not recommended— it typically does nothing but add issues to the macOS and competes directly with Apple’s own built in security:

macOS antivirus - Protecting against malware in macOS - Apple Support

Security and your Apple Account Security and your Apple Account - Apple Support

Apple Platform Security - Apple Apple Platform Security - Apple Support

Protecting against malware in macOS Protecting against malware in macOS - Apple Support

calgel wrote:

When my husband opened our MacBook Pro this morning, it said “You’ve been hacked”, and your computer has been shut down. Call this number. Then, he did, and whoever answered said they were Apple Security. It was then supposedly sent over to Wells Fargo. I could go on with more details, but Wells Fargo says this is a common hack.

…

Husband withdrew a substantial amount of $s and put it into a bitcoin machine at the direction of “Wells Fargo”.

I'm guessing that your MacBook Pro was not hacked – that your husband visited some Web site that popped up a "phishing" scam message, and that your husband fell for it. The people that your husband called were not Apple Security, but criminals, who, posing as security or tech support people, were happy to instruct him on how to pay them a large amount of money in a form that cannot be easily traced or clawed back.

It is very likely that these criminals were working out of a scam center in some foreign country where there is very little chance that they will be held to account for their crimes, let alone made to pay restitution.

However, I suppose there is a chance that your husband's Mac was hacked, or that he installed remote control software on it at the direction of the scammers, and in that case, you might be looking at something that would be beyond the scope of this forum.

If you have not done so already, you should immediately take steps to secure your Apple Account password, your Wells Fargo bank account password, and any other passwords that might have been compromised by a scam, or hack.

If you think your Apple Account has been compromised - Apple Support

Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Apple Support

U.S. Federal Trade Commission – How To Recognize and Avoid Phishing Scams

This isn’t going to get addressed around here.

We can tell you how to try to re-secure this Mac and your Apple Accounts and such, but — for reasons mentioned below — we will probably not be able to dig into the personal and background and technical details of what happened here.

You have at least two problems in evidence, one may be a hack or may be a scam, and the other is with communications about the withdrawal and transfer and whatever else is happening as a result of the hack or the scam.

Any money converted into cryptocurrency and transferred — and Wells Fargo is exceedingly unlikely to suggest purchasing cryptocurrency — is best assumed to be permanently gone. Not unless the recipients are later identified. There is no mechanism for payment reversals or claw-backs.

The discussions ahead here will involve some very personal questions, too. Questions that are not appropriate for asking or posting in this or most any other forum. And the response will likely involve a look at the Mac and its contents, and at details such as whether you have (and still have) backups and such, as well as investigating whether this was a hack, some sketchy app installed, extortion, a pop-up, or something else.

If you have the budget for digital forensics and incident response, Dragos is one of the providers in this realm.