Haunted Google Account?

Question

Not to be dramatic but at my level of inexperience, the title is what I'm left with. Hoping smarter people can point me in the right direction, so here goes...

A google account used in a school environment, on samsung chromebooks, has been compromised in an odd way. Documents that the student are working with on google drive/docs are being edited and "scary" pictures are inserted along with odd text.

So far, password changes and turning on 2 factor authorizations on the account have not stopped the edits from occurring. Some limited testing tells me that a password change invalidates all previously logged in sessions, so if this were another student or individual in real time editing and causing the issue, it should have kicked them out and solved it. The 2 factor authorization code that I tested is also only valid for a single login, with failed login attempts sending notices to the user. So I think I ruled out that someone is logging in with a repeatedly stolen username/password, like another person looking over a shoulder and copying the password.

Has anyone ever heard of a plugin/malware/extension that is meant to be a prank that would fit this? Or anything really, any other suggestions cause at this point I'm left with requesting that IT delete the account and start fresh...or that it's a ghost...

Thanks for any help.

Answer 1

To summarize the checks that can be done in order to assess wheather and how the account has been compromised:

• First of all see if the files in question are shared with other users (which may be the cause of the problem). Someone who might have had full access to the account might have granted himself access and now is still able to modify the files after losing the login credentials thanks to your intervention. Also the user might have accidentally shared a folder or more with a wrong user.
• See which applications have access to the account on the permissions page, look for suspicioius ones and, in the best case revoke access for all, for now at least.
• See any API access tokens have been created or are currently active. A list of which should be in the Developers Console under: Developers Console/apis/credentials
• In addition you can look at the security log
• Finally, of course, the user's computer itself or one of those having access to a share might be compromised or the users themselves may be involved.