We recently had an incident where two-factor authentication was enabled on a Gmail account but the account was sending spam messages. The device login activity shows no abnormal devices accessing the account. Is it correct to assume there is a piece of malware on one of the Macs accessing the account?
What is the best way to forensically search for the how the malware got onto the machine? What log files should I be checking to locate the ingress point?
Any and all ideas welcome.
from:
address in the header? Are the messages in Gmail's Sent folder?