unfamiliar google session even with 2FA

SharkyDarky said:

Google is showing an unfamiliar Chrome session on my account even though i use an authenticator app. if it really was someone else, i'm trying to work out what could still be left behind after changing the password.
i'm planning to sign out every device, remove old OAuth apps and app passwords, regenerate the backup codes, check Gmail forwarding and filter rules, confirm the recovery email and phone, and then add a passkey.
after doing that, could an OAuth grant, app password, Chrome sync session or changed recovery setting still let them back in? does Google's “sign out all devices” actually revoke everything, or is there another place i should check to make sure the old access is dead?

Click to expand...

Stavro said:

If you had 2FA enabled, my first suspicion would be a cookie stealer.

I'd treat the device as compromised, as well as all your other logged-in accounts. Do a force sign out on all your accounts, do a thorough scan (or even better, wipe and reinstall), then change your passwords after getting rid of the malware.

Click to expand...

wanggg said:

force sighn out means i must login everythings agin eh and u do this everyday or depends u care its not?

Click to expand...

Stavro said:

Do it once, clean your device, change your passwords, then relogin. As long as there's no malware left behind, it should only be a one time thing.

Click to expand...