A new folder - (in Russian!) has appeared on my OneDrive

This morning, 9/9/2023 at around 03:30 European Time, I started using my computer. About an hour later I noticed a stangely named folder had appeared in the root folder of my OneDrive with a name in Russian. I checked directly in OneDrive on the internet and it seems this mysterious folder was modified abouut 19 hours ago, i.e. sometime yesterday. I am 100% certain it was not there the day before yesterday. The folder is completely empty.


The folder name is "Документы". I ran this through Deepl Translate and the meaning is "Documents", "Docs", "Papers", "Files", or "Records"


I don't speak Russian, and my MacOS has always been in English and as far as I know I do not have any documents in Russian on my Mac, nor any Russian Kayboard. Nobody else has access to my OneDrive, which is also accessible on my phone and iPad.


In order to check that I was not dreaming, I used TimeMachine to check if this folder had ever existed before (I am looking on my Mac at MyName/Library/CloudStorage/OneDrive). As far as I can tell I have never had a folder named or "Документы" or "Documents" in the root folder of my OneDrive.


I also ran a spotlight search on my Mac for this Russian word. The word is not found anywhere on my Mac except for the newly created folder in OneDrive.


Does anyone have a theory as to what could have happened?


iMac

Posted on Sep 8, 2023 8:43 PM

Reply

Similar questions

11 replies

Oct 12, 2023 7:08 AM in response to Tricky57

As i experienced the same issue i was wondering, what could have been the reason for this new folder. I also checked latest activity on my account, and there have not been any unsuccessful sign-in-attempts for me, so i really dont think, that a hack was the reason. Especially because it wouldnt make any sense for a hacker to leave a russian named folder, just making the owner of the account suspicious.

My idea however was the following: May i ask you guys, if you are maybe using the scanner pro app to scan your documents and have that linked to your onedrive to upload the pdf-files to? Afaik scanner pro is run by an ukrainian company, which might explain the folder in russian language.

Oct 12, 2023 7:18 AM in response to Applesig

Applesig wrote:

May i ask you guys, if you are maybe using the scanner pro app to scan your documents and have that linked to your onedrive to upload the pdf-files to? Afaik scanner pro is run by an ukrainian company, which might explain the folder in russian language.

That's a good theory. Though, if the company is based in Ukraine, I would think they would be using Ukrainian rather than Russian. And that's definitely in Russian. In Ukrainian, "documents" is "документів".

Sep 8, 2023 9:33 PM in response to Tricky57

Many ways this could have been created, e.g. by accidental key clicks. But no way for anyone here to really tell.


I suggest that you delete the file and change your One Drive password (which may be your 365 password). Also change your login passwords or codes for each of your devices, and change your Apple ID password. Use good passwords and make sure you note what they are. Also change the password for your router.

Sep 9, 2023 4:08 AM in response to Tricky57

To Steve’s outstanding answer, I’d add the following:


While you’re on “Heightened Alert” it’s also a good time to audit and validate ALL data on your AppleID.


Login at https://appleid.apple.com/ and check EVERYTHING.


Pay particular attention to:


  • Devices which aren’t yours
  • Trusted Numbers which you don’t trust
  • 2-Factor Authentication Status
  • Recovery Key Status - If “on” verify that your Recovery Key is indeed “obtainable” in your “worst case scenario” (e.g. TOTAL loss of physical access to ALL of your IT & Comms devices - AND Home & Office - due to natural or manmade disaster impacting your entire region.


Commentary: IMO Recovery Key should only be “on” IF you ALSO have a very well-conceived - and routinely rehearsed - Disaster Recovery Plan.

Sep 9, 2023 11:00 PM in response to Chattanoogan

Chattanoogan, This is gold dust advice. I am following both your and Steve's advice step by step. It seems that I do need to be on heightened alert after I found the below in my Microsoft account. It seems that someone in China tried to access my account unsuccessfully.



It's not the first time I saw an attempt from China. Last time I thought nothing of it as the attempt was unsuccessful. I guess they were using my email adress as the login, with a password I had used for another app (I keep all my passwords different). I am using 2-Factor Authentication, and probably wouldn't have reacted to the alert if it happened.






Oct 5, 2023 5:38 PM in response to Tricky57

Strangely, I noticed the exact same thing in my OneDrive today - the same mysterious folder, with the same name in Russian.


I also found an unsuccessful login attempt in my Microsoft account, although it couldn't give me a location for the attempt. It was several days before the folder appeared though, and I don't see how an unsuccessful login attempt could have any effect on the contents on my OneDrive?


All solid advice above nonetheless, but I'm still baffled as to how this folder could have appeared as there were no successful login attempts I didn't recognise as my own.

Feb 1, 2024 5:48 PM in response to Tricky57

This happened to me on February 2nd, 2024. Does anyone know why this Russian folder appeared? I'm starting to get paranoid. The only thing I did recently was set up my OneDrive account on a new MacBook Pro M3. My old iMac has had the same account for a long time, and a Russian folder never appeared there.

It's possible this is an issue with apple rather than Microsoft and onedrive??

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

A new folder - (in Russian!) has appeared on my OneDrive

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.