Reply to thread

Message

<blockquote data-quote="piquiteco" data-source="post: 1042510" data-attributes="member: 96829">That was the first thing I did, in fact google asked me to change the password immediately as soon as I logged into my account. Then I removed all connected devices. I revoked the MFA and reactivated the 2FA with new seed. I think it was some malicious extension or it was compromised by some hacker who must have injected it into the developer&#039;s source code just don&#039;t know what it is. My computer is clean no scanner like Norton Power Eraser,&nbsp; Kaspersky KVRT, ESET online Scanner, EEK found nothing suspicious or malicious. This is a lesson and a warning to other users like me who keep installing too many extensions on their browsers and this goes to [USER=55987]@HarborFront[/USER] I will write in CAPITAL letters DO NOT IN ANY WAY INSTALL UNNECESSARY EXTENSIONS OR IF POSSIBLE NONE on your browsers if you have annoying ads use adguard desktop, nextdns, Pi-hole or at least uBlock Origin nothing else. The extension or whatever rogue app tried to steal my saved session through cookies, but they couldn&#039;t. According to google as soon as they logged in access was blocked when they noticed suspicious activity and everything was reset. I had to recover my account and confirm my identity. I already formatted my machine, but created a backup image for me to investigate later and find out what happened, I will restore on a VM and go deep until I find out what happened. After this incident I will clean up and remove all extensions that I do not use. <img class="smilie smilie--emoji" loading="lazy" alt="😔" title="Pensive face&nbsp; &nbsp; :pensive:" src="https://cdn.jsdelivr.net/joypixels/assets/6.6/png/unicode/64/1f614.png" data-shortname=":pensive:" />[SPOILER=&quot;Protect your account / Suspicious activity found&quot;][ATTACH=full]275817[/ATTACH][/SPOILER]</blockquote>

[QUOTE="piquiteco, post: 1042510, member: 96829"] That was the first thing I did, in fact google asked me to change the password immediately as soon as I logged into my account. Then I removed all connected devices. I revoked the MFA and reactivated the 2FA with new seed. I think it was some malicious extension or it was compromised by some hacker who must have injected it into the developer's source code just don't know what it is. My computer is clean no scanner like Norton Power Eraser, Kaspersky KVRT, ESET online Scanner, EEK found nothing suspicious or malicious. This is a lesson and a warning to other users like me who keep installing too many extensions on their browsers and this goes to [USER=55987]@HarborFront[/USER] I will write in CAPITAL letters [SIZE=4][B][U]DO NOT IN ANY WAY INSTALL UNNECESSARY EXTENSIONS OR IF POSSIBLE NONE[/U][/B][/SIZE] on your browsers if you have annoying ads use adguard desktop, nextdns, Pi-hole or at least uBlock Origin nothing else. The extension or whatever rogue app tried to steal my saved session through cookies, but they couldn't. According to google as soon as they logged in access was blocked when they noticed suspicious activity and everything was reset. I had to recover my account and confirm my identity. I already formatted my machine, but created a backup image for me to investigate later and find out what happened, I will restore on a VM and go deep until I find out what happened. After this incident I will clean up and remove all extensions that I do not use. 😔 [SPOILER="Protect your account / Suspicious activity found"] [ATTACH type="full"]275817[/ATTACH] [/SPOILER] [/QUOTE]

Verification