A (spoofed?) trusted device has logged in from an unrecognized location

Question

Recently my google account was hacked. I have 2-factor authentication turned on. 2-factor authentication was not required for the hacker to gain access to my account, nor did the hacker trigger Google's suspicious activity monitor. This is because the log in was enacted from a "trusted device" or so it seems.

However, the log-in was from a location I never visited with a device name I do not know.

See attached image:

The hacker managed to gain access to my bank account and other various accounts without triggering any of their 2-factor authentication blocks.

One more note: When the attack occurred, the device that I brought with me to Israel and then back to New York, as far as I can tell, was turned off; so it is unlikely that the hacker gained remote access to that device... but then again... maybe they did?

Any idea what happened to me and how I can make sure it doesn't happen again?

(They also managed to get access to my bank account, add a wire recipient (a process I usually have to verify over the phone with a human), and make a successful wire transfer... but let's stick to the Google question)

For the record, I have changed all of my passwords and ran a virus scan that came out without results. But since the 2-factor authentication was enabled on literally all of my services, there wasn't much more I could do.

Help!

Answer 1

Sounds like it's plausible that it could be a session hijack? If they were able to get past that many security barriers without triggering anything besides the geo-location, but there's a lot you'd need to question in order to narrow it down. Do you have any add-ons? Do you use google-chrome? Have you checked your login information against haveibeenpwned.com ?

Answer 2

If you’re using SMS 2FA it could be possible your phone number got spoofed and so the attacker was able to get a code to login to your account uneventfully.