How to remove spyware that steals Wi-Fi passwords

Spyware that collects your Wi-Fi network passwords and sends them to attackers is a serious form of credential theft. On Windows and Mac, exposed data may include a saved network key, browser password or text entered into a hidden form. The router administrator password is separate, although reused passwords can magnify the risk.

Use a clean device as your control centre to change passwords, revoke sessions and monitor access. In Australia, one NBN connection often supports phones, laptops, consoles and smart TVs, so one compromised endpoint can reveal credentials used across a home or small-business network.

Public Wi-Fi is routine around Sydney, Melbourne and Brisbane cafés, airports and universities, while routers sold by JB Hi-Fi, Harvey Norman and Officeworks may have weak settings. Spyware does not need public Wi-Fi; a malicious download, extension or hijacked account can install it at home.

Treat cleanup as incident response, not a single uninstall. Work methodically and preserve evidence if a workplace device is involved. Businesses and schools should involve their IT team before resetting accounts, browser profiles or hardware.

Spot signs of Wi-Fi credential theft

Look for unexplained data use, unfamiliar browser extensions, changed DNS or proxy settings, unknown router clients, repeated security alerts and unexpected sign-in prompts. Keyloggers can also capture a network password entered in the router administration page.

Determine what was taken: Windows network profiles, macOS Keychain, browser storage or a password manager may all hold credentials. If a password was reused for email, banking or mygov, change it immediately from a clean device instead of waiting for cleanup to finish.

Disconnect the device and run trusted scans

Disconnect the affected computer from Wi-Fi and the internet, but leave it powered on unless IT advises otherwise. From a clean device using mobile data, change your email password first, then banking, mygov and other accounts; enable multifactor authentication and revoke active sessions.

On Windows, update Microsoft Defender and run Microsoft Defender Offline from Windows Security. Next, use ESET Online Scanner as a secondary check, downloading it only from the vendor and never from an alert in the infected browser. On a Mac, update macOS, confirm XProtect is active and use a reputable scanner.

Scanning removes some threats but cannot undo credential theft. Close network-sharing, VPN and remote-access tools you did not install. If an unknown person can view the screen through them, disable access and seek professional support.

Remove malicious apps, extensions and persistence

Uninstall programs, profiles and extensions you identify as malicious. In Windows, check Installed apps, Startup apps, Task Scheduler and browser policies. On a Mac, inspect Login Items & Extensions, Configuration Profiles and extensions. Keep legitimate password managers, then reset affected browsers after removing unwanted policies.

Persistence can survive a normal uninstall. After rescanning, remove any recreated items and confirm that DNS, proxy and search settings are controlled by you or your organisation. If changes return, the infection or an unauthorised account may still be active.

Recognise fake security alerts

Pop-ups claiming your Wi-Fi is exposed are often scareware: fake system alerts used to sell useless software. Do not call the number, pay, allow notifications or grant remote control. Close the page, deny website permissions and remove the responsible extension or notification abuse from a clean browser.

If alerts persist, a compromised website may be generating them rather than a local infection. Review notification, home-page and search settings, then run a trusted scan. This guide to fake system alerts explains how to distinguish intrusive advertising from legitimate security messages.

Secure the router and rotate important credentials

From a clean, wired computer, open the router administration page and change both the administrator password and the Wi-Fi network password. Update firmware, disable WPS and unnecessary UPnP, and use WPA2 or WPA3 with a long, unique passphrase. Check the connected-client list for unknown devices.

NBN gateways supplied by Optus, Telstra, Aussie Broadband or another Australian provider may limit some controls. Use provider support to confirm who manages updates, or factory-reset a suspect gateway. If the router is clean, the saved Wi-Fi secrets may still remain on infected devices.

Reconnect only trusted devices and remove old networks from their saved lists. Rotate any online account that reused the network password. The Australian Signals Directorate’s Australian Cyber Security Centre offers recovery guidance for compromised accounts and devices.

Clean browser data and monitor access

Spyware may also record browsing history and send it to advertising networks. If searches redirect, extensions reappear or unknown profiles appear, follow the steps for browser-history spyware, then reset browser data only after removing the source. Check saved cards, autofill entries and downloads for misuse.

Review bank statements, email rules, sent messages and password-reset notices. Revoke unknown sessions, replace reused passwords with a password manager and ask your bank about suspicious activity. The Office of the Australian Information Commissioner can advise when personal data has been compromised under Australian privacy law.

Prevent recurrence and limit future exposure

After cleanup, reduce the chance that the same route works again:

• Keep Windows, macOS, browsers and router firmware updated.
• Store unique passwords in a reputable password manager; never reuse the Wi-Fi passphrase.
• Enable passkeys or multifactor authentication for email, banking and mygov accounts.
• Remove obsolete Wi-Fi profiles and revoke remote-access sessions on unused devices.
• Use a separate guest network for visitors and untrusted smart devices where supported.
• Review router clients, browser extensions and account sessions every few months.

Containment differs when monitoring may be coercive. If a partner or family member controls devices, accounts or location, avoid resetting a phone or router alone because it can erase evidence or alert the person. Contact eSafety or the Australian Support Centre on Digital Abuse for a safe plan; call 000 in immediate danger. Record dates, affected accounts and actions taken for workplace or insurance claims.