Two weeks ago I got a notice from Amazon that there was a suspicious charge on my account. My Amazon password is randomly generated, and not used anywhere else so my assumption was my Google Account had been compromised (it did not have a great password). I reset my google password, and that's when I noticed that the bad guys had added a filter to my e-mail which sent all e-mails from Google and Amazon to the Trash.

I assumed the matter was done, but today I got a notice from Paypal that someone was trying to purchase cloud hosting in Italy from my PayPal account. Again my e-mails from Paypal were sent to the trash:


I enabled 2FA on my google account, but I'm not convinced that will fix anything. I show no suspicious logins from any devices I don't own, and I removed access to 3 machines/phones which Google told me hadn't been used since 2012.

I have a MacBookPro at home, and a Win10 PC which has Remote Desktop enabled for a single account. I checked Chrome's history on the PC, and I saw a single entry for the cloud hosting site. I assumed my RDP password was compromised and changed it.

However, on my MBP I decided to check Chrome's history to see if I could more information, and low and behold I saw about 40 browser entries for Gmail, Paypal, and the Cloud Provider, over the course of about 90 minutes. Google claims all of those were on a Windows box:

Chrome's log

Since the PC had a single entry in the history, it appears the bad guys attempted to cover their trail, and missed a spot. However, from the time logs I know I was RDP'd into that box on the same user account while they were "browsing". I would occasionally notice that when I would click on Chrome on the Task bar to bring it into focus it would minimize instead of taking the focus. I have been seeing the Chrome minimizing when I mean to bring it to the front happen on rare occasions over the last week or two, but assumed it might be a mouse accidentally clicking too fast issue. That it happened 3 times or more in 20-30 minutes made it stick out. Given the intrusion was going on at that time, I now think that means some malicious program was running and controlling the browser even though it wasn't on top.

I can't find anything malicious though. Malwarebytes doesn't report anything. Process Explorer using VirusTotal.com doesn't report anything that I didn't purposely install. I have Windows Defender running. Strangely, C:\Windows\System32 and C:\Windows\System32\cmd.bat were listed as exclusions for Windows Defender. I don't remember adding them, and have removed them now.

What else should I check? I can't figure out where my point of compromise could be now, and no idea what I can do to detect it and lock things down. I verified that RDP only allows the same account to login once, so something else had to have been the attack vector.

  • 1
    If you don't have full network logging and you can't trust your PC logs then you don't have any way to determine where the compromise occurred. Recommendation is to wipe machines, rebuild with up to date versions/patches, use new passwords, and configure logging so that if this happens again you can identify it. – Rory Alsop Feb 9 at 11:37
  • yes as Rory comment , you can do that and also you can check for email forwarding in your gmail account ,have a look – Tejas Pandya Feb 9 at 12:26
  • @RoryAlsop How do I enable full network logging, and do you mean in my router, or in Windows? My PC logs don't appear to be compromised. – Mordred Feb 9 at 17:00
  • @Tej No email forwarding is on. – Mordred Feb 9 at 17:01
  • Mordred - typically when we look at a compromise, we want full forensic investigation of every device along the compromise path. Sometimes it's as simple as a malicious link directly compromising the target. Other times it's a chain of events from router to initial compromise, pivoting to other accounts/machines etc. – Rory Alsop Feb 9 at 19:18