---
title: Tip: if a hosted desktop running your trading bot is breached, changing the password is not enough; kill every broker session too | ctxsec
url: https://ctxsec.com/items/tip-trading-vps-rotate-and-kill-broker-sessions
description: ""
status: "tip based on GMO Internet's Desktop Cloud breach guidance (Oct 23-24)"
published: 2026-10-25
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-trading-vps-rotate-and-kill-broker-sessions.md)

tip based on GMO Internet's Desktop Cloud breach guidance (Oct 23-24)

2026-10-25

### Tip: if a hosted desktop running your trading bot is breached, changing the password is not enough; kill every broker session too

GMO's guidance after the Desktop Cloud breach makes a point that applies to any VPS running MT4/MT5, crypto bots or other always-on trading tools: some brokers keep existing connections alive after a password change, so an attacker can keep trading.

- Change the password from a device that never touched the VPS, then use the broker's portal or support line to end **all** sessions.
- Use investor (read-only) passwords wherever a tool only needs to watch, and keep trading passwords off the VPS when you can.
- Turn on 2FA and withdrawal allow-lists at every broker or exchange the bot touches.
- Treat the VPS as a shared-tenant system you do not control: do not save browser passwords, email logins or seed phrases on it.

Sources: [GMO Internet: 3rd report, timeline and scope (Oct 23, Japanese)](https://internet.gmo/news/article/248/) · [GMO Internet: 4th report on the Desktop Cloud cyberattack (Oct 24, Japanese)](https://internet.gmo/news/article/249)