Not to be dramatic but at my level of inexperience, the title is what I'm left with. Hoping smarter people can point me in the right direction, so here goes...
A google account used in a school environment, on samsung chromebooks, has been compromised in an odd way. Documents that the student are working with on google drive/docs are being edited and "scary" pictures are inserted along with odd text.
So far, password changes and turning on 2 factor authorizations on the account have not stopped the edits from occurring. Some limited testing tells me that a password change invalidates all previously logged in sessions, so if this were another student or individual in real time editing and causing the issue, it should have kicked them out and solved it. The 2 factor authorization code that I tested is also only valid for a single login, with failed login attempts sending notices to the user. So I think I ruled out that someone is logging in with a repeatedly stolen username/password, like another person looking over a shoulder and copying the password.
Has anyone ever heard of a plugin/malware/extension that is meant to be a prank that would fit this? Or anything really, any other suggestions cause at this point I'm left with requesting that IT delete the account and start fresh...or that it's a ghost...
Thanks for any help.