Two weeks ago I got a notice from Amazon that there was a suspicious charge on my account. My Amazon password is randomly generated, and not used anywhere else so my assumption was my Google Account had been compromised (it did not have a great password). I reset my google password, and that's when I noticed that the bad guys had added a filter to my e-mail which sent all e-mails from Google and Amazon to the Trash.
I assumed the matter was done, but today I got a notice from Paypal that someone was trying to purchase cloud hosting in Italy from my PayPal account. Again my e-mails from Paypal were sent to the trash:
I enabled 2FA on my google account, but I'm not convinced that will fix anything. I show no suspicious logins from any devices I don't own, and I removed access to 3 machines/phones which Google told me hadn't been used since 2012.
I have a MacBookPro at home, and a Win10 PC which has Remote Desktop enabled for a single account. I checked Chrome's history on the PC, and I saw a single entry for the cloud hosting site. I assumed my RDP password was compromised and changed it.
However, on my MBP I decided to check Chrome's history to see if I could more information, and low and behold I saw about 40 browser entries for Gmail, Paypal, and the Cloud Provider, over the course of about 90 minutes. Google claims all of those were on a Windows box:
Since the PC had a single entry in the history, it appears the bad guys attempted to cover their trail, and missed a spot. However, from the time logs I know I was RDP'd into that box on the same user account while they were "browsing". I would occasionally notice that when I would click on Chrome on the Task bar to bring it into focus it would minimize instead of taking the focus. I have been seeing the Chrome minimizing when I mean to bring it to the front happen on rare occasions over the last week or two, but assumed it might be a mouse accidentally clicking too fast issue. That it happened 3 times or more in 20-30 minutes made it stick out. Given the intrusion was going on at that time, I now think that means some malicious program was running and controlling the browser even though it wasn't on top.
I can't find anything malicious though. Malwarebytes doesn't report anything. Process Explorer using VirusTotal.com doesn't report anything that I didn't purposely install. I have Windows Defender running. Strangely,
C:\Windows\System32\cmd.bat were listed as exclusions for Windows Defender. I don't remember adding them, and have removed them now.
What else should I check? I can't figure out where my point of compromise could be now, and no idea what I can do to detect it and lock things down. I verified that RDP only allows the same account to login once, so something else had to have been the attack vector.