PanicStation.org
UK USA
us Technology & digital loss unknown folder syncing • shared folder appeared • random files downloading • unexpected cloud sync • onedrive syncing unknown files • sharepoint library started syncing • google drive desktop syncing unknown • dropbox folder syncing files i don’t recognize • new folder keeps updating • computer syncing without permission • device linked to wrong account • someone shared a folder with me • suspicious sync activity • cloud account compromised • unknown files in my folders • unwanted shared folder • mystery shared drive folder • sudden files appearing • shared folder on my computer

What to do if…
a shared folder suddenly appears on your computer and starts syncing unknown files

Short answer

Stop the sync first (pause/quit the sync app or go offline), then confirm which cloud account/service is responsible before opening anything. If you suspect account access, secure the account from a different device.

Do not do these things

  • Don’t open the unknown files “just to check” (especially .exe/.msi installers, shortcuts, or documents asking to enable macros).
  • Don’t move/copy the unknown files to other folders while sync is active (it can multiply changes and spread risk).
  • Don’t keep clicking “keep on this device / always available offline” on unknown items (it forces more downloads).
  • Don’t click “shared folder” links from unexpected emails/texts to investigate—use the official app or type the service address yourself.
  • Don’t wipe the computer immediately unless you’ve confirmed compromise; you may lose clues you need (and it’s rarely the first best move).

What to do now

  1. Freeze the syncing (make it stop changing).

    • In the sync app (OneDrive / Dropbox / Google Drive), pause syncing or quit.
    • If you can’t find the app quickly, disconnect from the internet (Wi-Fi off / unplug Ethernet) to stop new downloads.

  2. Figure out which account and service is doing it.

    • Look at the folder’s location/name for clues (e.g., OneDrive, Dropbox, Google Drive, iCloud Drive, SharePoint).
    • Open the sync app’s Account settings and note the signed-in email(s). Many people have both personal + work accounts connected.

  3. Stop syncing the specific folder/library (don’t “delete first”).

    • OneDrive/SharePoint: use the built-in option to stop syncing the folder/library, or unlink this PC if the wrong account is attached.
    • Dropbox: use selective sync to remove the folder from this device (without deleting it from the cloud).
    • If you’re not sure which setting applies, keep sync paused until you confirm.

  4. Check if it was shared to you (legit) vs added by an attacker (not).

    • Search your email for “shared”, “invited”, “OneDrive”, “Dropbox”, “Google Drive”.
    • In the cloud service’s web view, check Sharing / Recent activity / Devices to see when the folder was added and from whom.

  5. If compromise is plausible, secure the cloud account from a different device.

    • Change the password for the cloud account involved.
    • Turn on multi-factor authentication (MFA) if it’s not already enabled.
    • Sign out of other sessions and remove unknown devices where the service offers it.

  6. Run a basic security check before you resume syncing.

    • Update the operating system and run your built-in security scan.
    • If this is a work/school-managed device or account, notify IT/security with: folder name, service, signed-in account email, and the time it started.

  7. If you’ve lost money or this looks like cyber-enabled fraud: report it (USA).

    • You can file a report with the FBI’s Internet Crime Complaint Center (IC3) using the official site.
    • If identity theft is involved (accounts opened in your name, SSN misuse, tax/benefits fraud), also use the FTC’s IdentityTheft.gov recovery/reporting pathway.

What can wait

  • You do not need to decide today whether to permanently delete anything from the cloud.
  • You do not need to review every file right now—focus on stopping sync and identifying the account/service.
  • You do not need to reinstall your computer as your first move unless a trusted IT/security professional advises it.
  • You do not need to message whoever “shared” it until you’ve confirmed it’s legitimate.

Important reassurance

A surprise “shared folder” is often caused by something reversible: a second account signed in, a work SharePoint library being synced, or an accidental share. Pausing sync and confirming the account behind it is the safest way to regain control without making things worse.

Scope note

These are first steps to stop further syncing, avoid opening risky files, and collect the key details you’ll need for IT support or reporting. Deeper remediation can come after the situation is stable.

Important note

This is general information, not legal or professional IT advice. If the unknown files could include sensitive data (work, medical, financial), treat it as a potential security incident and involve your organization’s IT/security team promptly.

Additional Resources
Support us