my email just hacked, no 2 factor auth. request or new sign in? Am I infected?

Question

Gmail.

I just received two emails sent from my own account that I did not send. They are in my sent messages as well so were not spoofed.

I have on this account(and all my accounts):

• STRONG unique password, changed frequently
• 2 factor authentication tied to my phone
• backup email

I received no 2 factor code, new sign-in alert, or ANY notice at all of an account sign-in before receiving the messages from myself.

The attacker did not even try to actually do anything, like change my password or phone number, but just spammed a bunch of other email addresses from me and cc'd me(?).

The only possible way I can think of this happening is someone hijacking the signed-in session of gmail on my desktop, why explains why there was no new sign-in attempt.

How possible do you think this is given that I run Chrome on Linux, no Windows at all? Should I consider my desktop to be infected and wipe it?

Please, beyond changing all my passwords again, what should I do?

Answer 1

It's a simple spoofing attack. Gmail is showing sent items not based on what was truly sent but on "from" address that matches your e-mail address. So you received an e-mail that has your e-mail address as to/cc/bcc and from at the same time, you will see in there but the e-mail wasn't sent from your account.

to check that, grab headers from original of one of the spam emails and drop it in this tool, and you will see under section "from" who originated it.