A tool that helps you notice the changes to your PC and the measures I took triggered by unauthorized VPS access

Now, the hacking incident that is stirring the world.
What did you all think about it?
Some people may have thought, “That’s scary,” and others may have worried, “Am I safe?”
Honestly, I felt afraid.
When you run EA, even when you’re not at home, the PC or VPS keeps running, right?
Have you ever thought, “If something changes on that PC, I’d like to know right away?”
This time, triggered by the recent unauthorized access to a VPS, I’m going to tell you what I actually did and the small tool I made to notice changes on my PC.
It’s not a grand story; I’ll gently share my experience and preparations you can start today.
It’s a bit long, but please stick with me.

1. The thought that “It’s scary” was the trigger

Because I have EA running, I wanted to know immediately if there is any change on my PC when I’m not at home.
Recently, I often hear about large companies being hacked.
Honestly, I felt scared.
This is, of course, my own feeling.
And I myself was using Onamae.com Desktop Cloud, and was affected by this incident.
To be honest, up to now, I had thought hacks and data breaches reported in the news were someone else’s problem, and hadn’t paid much attention.
But once I became a person who could be affected, I realized my preparations were all behind the times.
“Is there any simple defense I can do?”
That’s what led me to create this tool.

2. About this incident (from the official announcement)

First, let me lay out the facts.
I’m writing this in line with the official announcement.

• Target: Onamae.com Desktop Cloud (VPS for FX automated trading).
  Not the entire “Onamae.com VPS” line
• GMO Internet announced this on October 21, 2026
• There were unauthorized programs left on servers used by some users due to unauthorized access by a third party.
  The number of potentially affected servers: 26,739
• The company says, “We have not confirmed any leakage of personal information or misuse of accessed information at this time.”
• Users are requested to change IDs and passwords stored on the servers (FX account login info, etc.).
• Be careful of impersonation emails or phone calls.

The situation may change from here.
Please always check the official announcements for the latest information.
Official announcement: Onamae.com (GMO Internet) December 21, 2026 notice.

I’m not blaming Onamae.com or GMO.
I think about accepting what happened as a fact and doing what I can as a user.
That’s all.

3. The emails and my account that reached me

The “first email” that reached me and acquaintances

Actually, the first email (dated October 24, 2026) from a sender calling itself the “hacking team” arrived at my mailbox.
This email seemed to have been sent to many people at once, and many of you may already know about it.
Some of my acquaintances received the same email.
That acquaintance has no relation whatsoever with the companies affected by this incident.
I think my registered email address may have been read from somewhere.
However, this is just my guess.
The official announcements do not say this.
I cannot confirm whether the content of this email is true.
Please do not click the links in such emails.

In other words, even if you are not using the affected service, you may receive a similar email.
If you receive an unsolicited email, do not click links or open attachments; first compare with official announcements.

About my account on the VPS

In my case, there was no damage to the account on the VPS.
However, I saw posts on X (formerly Twitter) from people who suffered substantial damage.
I have not verified the numbers or specifics beyond what I saw.
But this is within the scope of what I could confirm in my environment.
We cannot say the same for others.
That’s why I recommend changing passwords and checking logins as a precaution.

4. What I actually did right away

After learning about this incident, I immediately did the following, and I’ll write them exactly as I did:

1. Change almost all possible passwords
2. Run antivirus scans with several programs (full scan with Windows Defender, Microsoft official scanning tools, etc.).
   No threats were found within the confirmed scope
3. While checking the PC, I found that the Windows “Remote Desktop” had been left on even though I wasn’t using it.
   I turned it off
4. Deleted the Remote Desktop connection history (server names) from the PC
5. Created a monitoring tool to notice changes on the PC

Finding nothing in a virus scan does not mean you are not infected or that you are completely safe.
What I could confirm was only that nothing was found.
And my experience is just one example.
It may not apply to all environments.

3rd thing: “Something on but unused was left on.”
This is surprisingly easy to miss.
Just reviewing how that setting was can be a good preparation.

5. What the tool “SecurityWatch” is

I made a small tool for Windows called “SecurityWatch.”
I’ll tell you the most important thing first.
SecurityWatch is not something that prevents intrusions.
It’s a tool to help you notice that you’ve been compromised or that your PC has changed.
It cannot replace security software.

SecurityWatch is not an application (program); it’s a script.A script is a file containing instructions for the computer (it runs via Windows PowerShell).
Therefore, it does not have the full features of commercial security software.
If you can purchase, using security apps (security software) is recommended.Use this tool as a supplement to help you notice changes.

How it works

• It checks the PC status every 5 minutes
• If there is a change, it notifies only your own Discord
• Once a day, you also receive a message that it is running
  If that stops, that’s a sign the tool stopped
• Notifications are only to your own Discord
  The author does not receive anything
  Passwords or keys are not included in the notifications

What it monitors

• Whether startup programs have increased
• Whether new scheduled tasks have been created
• Whether new services have been added
• Whether new users or administrators have been added
• Whether new entry points (ports) have opened
• Whether remote control software has appeared
• Whether Windows Defender protection is turned off
• From outside: consecutive successes and failures of login (checked with admin consent)

What cannot be seen

• Files or browser contents being taken out
• The activity within EA
• The moment a change occurs (up to 5 minutes late)

It’s not about “protecting everything”; it’s about making it easier to notice when something is different.

The contents are all readable

There are only four files (SecurityWatch.cmd, SecurityWatch.ps1, README.md, LICENSE).
The main body is a single file, and you can read all of its contents before using if you’re curious.

Prepare first: Create a Discord Webhook URL

To receive notifications, you need the URL of a Discord Webhook.
You can create it with the following steps.

1. Prepare a server on Discord to receive notifications (a server only you own is recommended)
2. Open the gear icon (edit channel) for the channel that will receive notifications
3. Open “Integrations”
4. From “Webhooks,” create a “New Webhook”
5. Click “Copy Webhook URL” for the created webhook
6. Paste that URL during the installation later

The Webhook URL is like a password.Do not show it to others or include it in screenshots (someone who knows the URL can send messages to your Discord).
Discord’s interface and menu names may change.
If you can’t find it, also check Discord’s official help.

You can also receive notifications on your smartphone

Install the Discord app on your phone and log in with the same account; notifications will also arrive on your phone.
Even when you’re away from home, you can notice things quickly.
On your phone, please enable Discord notifications.

How to install

Download and installation steps are summarized at the very end of this article.

6. The tool’s mechanism: imagine it as a “home surveillance agent”

Terminology can be heavy, so I’ll explain it as the “home surveillance agent.”
Installing the tool is like hiring two quiet agents to surveil your home.

• The surveillance agents do not appear on screen.Every 5 minutes they inspect the inside of the house
• First, they take a single “photo” of the inside as a baseline.
  From then on,they compare with the photo and notify the owner’s phone (Discord) only where there are differences.
• If nothing changes, they say nothing (they stay quiet)
• Every day, they send a message that the surveillance agents are active.If this stops, it’s a sign the surveillance agents are gone (stopped).

If you explain installation as a story

1. Press “Yes” (administrator permission) = grant the surveillance agents permission to look around the house
2. On the explanation screen, press “Yes” = confirm the surveillance details (what to look at, what to change) and then start the work
3. Paste the Discord Webhook URL = “If there is something, please contact here,”give the surveillance agents your phone number.
   This number is written only in the agents’ notebook (on your PC) and is not given to the author
4. Windows settings (log size, logging settings) = replace the entryway’sguest bookwith a larger one (about two weeks worth) to ensure you can record who came and when
5. Hire two surveillance agents = create two Windows “Scheduled Tasks”

As in item 4, this tool changes some Windows settings (log size and logging configuration).
If you’re curious, read the script contents first or confirm the details on the explanation screen.

Roles of the two surveillance agents

House-inspecting agent
How they surveil:They watch for more furniture, extra keys, open windows, new inhabitants, and such
What they actually monitor:Automatically starting software, new scheduled tasks, new services, added users or admins, new entry points (ports), appearance of remote-control software, Windows Defender protection turned off

Front door notebook watcher
How they surveil:Read from the notebook about outsiders who came, failed attempts to enter, and new residents
What they actually monitor:External login successes, consecutive login failures, creation of new users, additions to groups, new services registered

What can and cannot be done

Can:Notice that furniture has increased
Cannot:Stop someone from entering(keys are handled separately: passwords, two-factor authentication, closing unused remote access)

Can:Read visitor records written in the notebook
Cannot:Notice if someone took documents inside the house by taking a photo

Can:Look every 5 minutes
Cannot:Notice at the moment of entry (up to 5 minutes late).

This tool is not a “key,” but a combination of a surveillance agent and a security camera.Please think of it as a tool to help you notice changes, not to guarantee safety.

When you want to stop

If you reopen the same file and choose “Delete” again, both surveillance agents disappear.
The notebook (records) also clears.
However, the notebook’s size setting remains as is.

7. About notifications

Examples of changes

For example, when an unknown spare key (a new user) is created, you’ll receive the following on your phone (Discord).
⚠️ Surveillance: ➕ [User] added: ○○ (time)
When you get a notification, please check whether it is familiar to you.
If it isn’t familiar, follow the service provider’s guidance and professional advice to investigate and respond.

Even Windows’ standard behavior can generate notifications

Windows itself creates and deletes its own scheduled tasks.
So a notification you don’t recognize isn’t necessarily bad.
On my PC, I also received notifications about a scheduled task named “SoftLanding” being added or removed.
It seems to be one of Windows’ own tasks rearranged by itself.
To verify, open “Task Scheduler” and look at the creator.
If it says “Microsoft Corporation,” it’s a Windows task.
If you don’t recognize it and can’t identify the creator, follow the service provider’s guidance and professional advice.

There is a record of anything that happens here

Tool logs are stored in the following folder.
C:\ProgramData\SecurityWatch\
You can open it by pasting this location into the Explorer address bar and pressing Enter (ProgramData is normally hidden).

• alerts.log: notification records.
  Can be opened with Notepad.
  Useful to verify if Discord notifications failed (if sending to Discord fails, it will also be recorded here)
• baseline.json: the PC’s “baseline state” (the first captured photo)
• webhook.txt: the Discord Webhook URL.
  Do not show to others

If you delete the tool, this folder is deleted as well.

8. What you can do today

There are preparations you can make without using the tool.
Please review the following checklist.

1. Stop password reuse (especially FX accounts, email, Google accounts)
2. Enable two-factor authentication (Google accounts, brokers, etc.)
3. Turn off unused Remote Desktop (Windows RDP)
4. Turn on the broker’s login notifications
5. Review IDs and passwords stored on the VPS.
   Do not store passwords inside the servers
6. Beware of impersonation scams (fake emails, phone calls, websites).
   Do not open links or attachments in unsolicited emails

For impersonation scams, verify via official channels (official site and registered email).
Do not log in via links in emails or calls.
If you suspect unauthorized access, follow the service provider’s guidance and professional advice.

9. Cautions for use

Please use SecurityWatch with the following in mind.

• It is not a replacement for security software.
  This tool is a script.
  If you can purchase, it is recommended to also deploy security apps.
  It is not something that prevents intrusions; it’s a tool to help you notice changes.
  There is no guarantee of safety.
• My testing has been in Windows 11 with default Windows Defender only.
  I have not tested on PCs with other security software or other Windows editions.
  Functionality is not guaranteed; warnings may appear or it may not run.
• This is the first version and still under testing.
  The author is not responsible for damage caused by use.
• My experiences are just one example.
  It may not apply to all environments.

Summary: Being able to notice is the best defense

From this incident, I felt that serious damage is not someone else’s problem.
But you can’t just be afraid and stay still.
Review your passwords.
Close unused entry points.
And have a mechanism to notice changes.
I want to accumulate such small preparations.
SecurityWatch is a small tool toward that goal.
Please give it a try if you’d like.
For the latest information, please check the official announcements.

Note

This article is for information purposes and is not investment advice.
What is described here is one person’s experience and does not guarantee effectiveness or safety.
Use of the tool is at your own risk and judgment.

For those who want to use this

As a layperson, I diligently created this modest tool by chipping away at ideas.
There are surely many inadequate aspects.
I’m sorry for that.
Still, if there are people who want to try it, I would be very happy.
Downloads are available from the attachments of this article.

Download and installation steps

I will outline the steps from download to installation in order.
I also confirmed that it can be performed on another PC—from download to installation.

1. Download the attachment “SecurityWatch.zip” for this article
2. ZIP →Right-click → “Extract All”
3. In the extracted folder,Double-click “SecurityWatch.cmd”
4. Choose “Yes” (permission) → “Yes” (install) and paste the Discord Webhook URL

When you extract the ZIP, there are four files inside.
After installation finishes, within 1–2 minutes you will receive a Discord notification that it has started.
Every day you will also receive a notification that it is running.

Common stumbling blocks

• If you download on a phone, it won’t run on a PC.
  Please download on the PC where you will install it.
• Windows SmartScreen or antivirus software may display warnings.
  This tool is for registering scheduled tasks and changing Windows settings.
  Everything inside can be read.
  If you’re uneasy, do not install.
• If you want to delete, open the same file again and choose “No” (delete)