My google account was compromised recently, and I'm trying to go through all details to understand how. Maybe you guys have ideas.
I discovered a few days ago that my gmail account had the following settings:
- Filters to automatically delete certain incoming messages
- IMAP setup
- Application Specific Password (not sure when created, Google does not tell me)
I have a strong password that I use for google kept in a password manager. I also use 2FA on this account. In addition, I access my account through a Linux machine and a windows machine that run Malwarebytes. I have not seen any warnings or notifications of malware on those machines. The browser is Google Chrome, but uses a limited set of addons. I have not installed any new plugins for months.
My theory is that something I did allowed an application specific password to be created in the Google account. I recall about a week ago using single sign on to access a new site that I now think was very sketchy. During this time, I noticed that I should probably not use single sign on for my main account. Instead, I created a temporary fake gmail account to perform the single sign on, and I used that instead. Keep in mind that I maintained the browser session with my main google account, but the permissions were given for the fake account.
Is it possible that using single-sign on (even with a different account) can add an ASP to my main google account just because I had a browser session opened at that time? Are there any vulnerabilities in single-sign on that I need to be aware of here?