There is a malware which is spreading nowadays that clone the ID of chrome, so an attacker can access any site/s thanks to cookie sessions saved on that chrome. The technique is very sophisticated and 2FA it's useless here because they're already logged in with your cloned browser id and nothing require to be checked. So most probably, if you're a google chrome user, you could have been affected by this kind of attack. If this is your case, the solution will be as follow:
·LogOut your google account from the infected machine (of course, run
Malwarebytes or any other kink of anti-malware to delete the virus)
·Uninstall google chrome and/or any kind of chromium-based browser(and
all of its related data)
·Now you need to change the name of your computer (so the new session
will have a different name avoiding name hijacking
·From a different device change the password of your google account
·In 2FA google settings revoke all authorized devices
·Reboot your pc and reinstall chrome.
You should be done.