If you entered your password into a fake website, treat the password as exposed even if nothing appears to have happened yet.
Go directly to the real service by typing its address yourself or using an official app. Do not follow the suspicious link again.
Change the password immediately. If the same password was used on other accounts, change those passwords too.
Check the account's active sessions, logged-in devices, recovery email address, phone number, and other security settings. Remove anything you do not recognise.
Enable multi-factor authentication where available. This adds another barrier if someone already knows the password.
If you entered banking, payment, or other highly sensitive information as well, follow the relevant incident guidance rather than treating this as only a password problem.