I just received two emails sent from my own account that I did not send. They are in my sent messages as well so were not spoofed.
I have on this account(and all my accounts):
- STRONG unique password, changed frequently
- 2 factor authentication tied to my phone
- backup email
I received no 2 factor code, new sign-in alert, or ANY notice at all of an account sign-in before receiving the messages from myself.
The attacker did not even try to actually do anything, like change my password or phone number, but just spammed a bunch of other email addresses from me and cc'd me(?).
The only possible way I can think of this happening is someone hijacking the signed-in session of gmail on my desktop, why explains why there was no new sign-in attempt.
How possible do you think this is given that I run Chrome on Linux, no Windows at all? Should I consider my desktop to be infected and wipe it?
Please, beyond changing all my passwords again, what should I do?