0

Yesterday I downloaded a sketchy .exe on my Windows desktop and executed it. A command prompt window appeared then nothing abnormal happened. I tried running MalwareBytes but it didn't display any threats.

Today at 4 am someone tried to log in to my secondary google account, then google detected and disconnected the account. When I woke up 4 hours later I changed the password of my secondary and primary account on my notebook (other device) and wiped the desktop SSD and HD clean with a boot usb and installed Windows once again. Then I downloaded apps such as Firefox, Steam and logged in to my primary and secondary accounts on Firefox.

At 8:30 pm Google once again stopped someone trying to log in my account, this time in the primary. The email I received from google (translated):

Suspicious activity on your account

Someone could have accessed your Google Account using rogue malware on one of your devices. The account has been logged out on the device in question for security reasons.

I already changed my primary google account password once again.

Is it possible the malware is still alive on my desktop despite deleting and creating again the SSD and HD partitions?

Can someone access my google account ignoring the MFA authentication?

Could it be they still had a session of my primary google account "alive"?

Here is the original message (in portuguese)

Atividade suspeita na sua conta

Alguém pode ter acessado sua Conta do Google usando um malware nocivo em um dos seus dispositivos. A conta foi desconectada no dispositivo em questão por motivos de segurança.

2
  • 2
    Could it be that wasn't Google that sent you the email? I don't think Google would warn about rogue malware on your devices. Did the email had any links on it? Could you add the untranslated email Google sent?
    – ThoriumBR
    Oct 11, 2022 at 3:10
  • Hi @ThoriumBR, thanks for the message, original email added. It is indeed from google, it even has a button "Taken Action" that takes to google account security. Sadly it hasn't much information on the perpetrator besides it its from a windows machine. I'm starting to think it is a false positive and unfortunate timing it happened after I clicked the exe file.
    – Guilherme
    Oct 11, 2022 at 12:17

1 Answer 1

0

That executable could have been a Data Stealing Malware. They go after credentials, saved sessions, passwords and upload them to the operator.

In this case, reinstalling the OS will not solve the problem, because your data has already been stolen. You must change all passwords on all services you have, because your credentials are in the possession of the attacker.

If you don't have a password manager, it's a good time to start using one.

Is it possible the malware is still alive on my desktop despite deleting and creating again the SSD and HD partitions?

It's possible, but the probability is too low to consider this as a factor. Unless you are a wanted criminal, journalist, politician, or other "high risk" person that would justify investing on a sophisticated malware tailored just for you.

Can someone access my google account ignoring the MFA authentication?

If they have the access tokens (they probably have), they still have access to the account. To block them, you must go to Google Account settings and invalidate the access on all accounts.

Could it be they still had a session of my primary google account "alive"?

Yes. They can access your account even if you are online.

2
  • The OP said they changed the password, reinstalled, then a different account with a changed password was logged into. By changing passwords, that should also invalidate other live session tokens. So, I'm not sure this is the answer.
    – schroeder
    Oct 11, 2022 at 14:22
  • I use firefox as a password manager, so they might have all my accounts credentials from firefox?
    – Guilherme
    Oct 11, 2022 at 15:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .