1. A method comprising: detecting, by a computing device, one or more content items stored in a folder on a client device associated with a first activated user account, wherein the folder of the client device is synchronized to a storage device hosted on the computing device; uploading the each of the one or more content items stored in the folder on the client device to the storage device hosted on the computing device, such that the first activated user account can access each of the one or more content items on both the client device and another client device associated with the first activated user account; detecting, by a computing device, a malicious activity associated with the first activated user account; scanning each of the one or more content items to identify malware contained in at least one content item of the one or more content items, responsive to detecting the malicious activity associated with the first activated user account; in response to identifying malware contained in the at least one content item identifying, by the computing device, that at least the second activated user account of the computing device is related to the first activated user account based on at least authentication data associated with the first activated user account and the second activated user account, wherein the authentication data are stored on the computing device and the authentication data includes a referral account identifier linking the second activated user account to the first activated user account; and blocking access of the first activated user account or the at least one second activated user account to the storage device hosted on the computing device.