What to do, next time and this time

If you think you clicked something: do not wait to be sure. Change the email password first, then Discord, then sign out all devices, then check authorised apps. That order is the whole trick - it is on your recovery checklist.

If nothing appeared to happen: that is not evidence of safety. Plenty of these do their work quietly. Run the checklist anyway; it costs you ten minutes.

If it came from a friend: tell them, through some channel other than the compromised one. They may not know yet.

Tell AGN. Not to get anyone in trouble. If your account sent links to other members while it was not yours, staff need to warn them, and the timeline makes it obvious it was not you.

The single habit worth keeping: never sign in from a link. If you need to log into Discord, Steam or Cfx.re, type the address yourself or use the app. That one habit defeats almost everything in this course, including the attacks that have not been invented yet.