I was yesterday informed by some friends that they received spam mails with my name as sender. The sender addresses look like [email protected] and [email protected] with the subject line "from: Firstname Lastname" and the mail containing only a link and my name as signature (and one mail also stated "Sent from my iPhone").
It seems like the mails are not sent from my Yahoo mail (as the sender is not Yahoo and they are not in my sent mails folder), but the list of people receiving these mails has to come from my Yahoo account as I only have mailed with them from Yahoo! Note: they are not from my contact list! It looks to me that the addresses come from my sent mail folder as one receiver is listed twice, once with the correct mail and once with a typo I made when typing the address some months ago. The list has to be extracted between April/May and yesterday which I can say for sure because of some of the recipients which I did not mail with before that time.
I have changed the password and security questions asap and checked also the alternate email address, cell phone, website connections and account activity but could not see anything fishy. The account activity goes back to 8th of July and there was nothing I could not explain.
I read about this XSS hack from 2012/2013 but thought the hole was closed. Is it still open?
The last couple of weeks I almost only used my iPhone for online activity. Could it be that there is some virus/malware on the phone? I only downloaded apps from the official Apple store!
Is it enough to change the password and security questions or should I take some further steps?
Note: my password was strong with both upper and lower case, numbers and special characters and was changed 6 months ago. Only mistake: I used the same password on a couple of other (trusted) sites.
How could did this happen? I am nearly paranoid when it comes to security and I did not click on any link in any email (I even cannot recall receiving some strange mails lately).
EDIT: Found this article today Hackers exploit flash vulnerability in Yahoo Ads
Even though the article does not say a word about this kind of attack I was exposed to this might be an explanation! I swear that I did not surf around on shady pages :)
Next question: how can I make sure that my PC is clean? When the attack was run I was using my Win7 laptop (even though the mails were sent while I was offline). I am now writing from my Linux comp as I do not dare to turn on the Win7.