Gmail Phishing - fake email sent to a family member from my draft folder
Hello all,
Just hoping I could get some insight into an incident that happened a couple days ago that has left me quite confused - I know a lot of members here are very knowledgeable when it comes to these things and can maybe help figure out how it all happened.
2 days ago I had a discussion with my dad about printing off a passport application document as our printer decided to stop working. This conversation happened in person and there was no discussion via text, email, about it. I attached the document and addressed to my dad's email address - I never sent the file however as I noticed I needed to change one thing on it.
About 2 hours later, my dad texted me saying he was having issues downloading the attachment, and if I could send it again in PDF form (of note, it was a standard PDF - downloaded right from the government of Canada website) and asked me to send it again. I was a little confused because I thought I just had it in the drafts but didn't think anything of it and figured I mouse slipped and sent it by accident. When I went back into my Gmail it was still sitting in my drafts. Again, I thought I had just sent another one by accident and didn't bother to check my outbox. He had no issue opening it this time and printed it.
Yesterday morning, I get a text from my dad saying they were having computer issues and took their laptop in to be diagnosed. The tech found malware, specifically, ScreenConnect.ClientSetup.msi. I then learned that the initial email that my dad thought I sent came from a different email address entirely: *myname-fakedomain* rather than, *myname-realdomain*. In the fake email there was a link to accept screen sharing capabilities, and unfortunately he clicked on it and the software was installed, meaning whoever had access to the computer had it for approx. 12hrs. The email that he received from the incorrect domain had the same subject line that my draft had.
They had some sensitive financial documents stored on their laptop, as well as personal information. All steps have been taken to contact our banks, credit card companies, Equifax, etc, so hopefully nothing comes of this. Also, we aren't certain exactly what these scammers were able to view and what they were looking for. They never locked the computer or demanded any ransom to unlock it either.
Seeing as how the email was sent had the same subject line, it seems to me (as well as all my extensive one-day of research with the assistance of google and AI), that someone must have had access to my Gmail. Windows Defender did not report any malicious attempts on my PC, and an offline scan also did not locate anything. I spent about 8 hours with the help of forums, Chat GPT, looking through files (Powershell logs, Google account connections, program files, etc) to try and find any sign that my PC has been compromised but everything has come back as ordinary and not concerning.
One thought was that I played Mecca Chameleon about a month ago and didn't delete all program files associated to the game after there was that malware release through some of the workshop levels. I didn't think it was necessary since I didn't play the map that apparently the software had been within. But I suppose it could have been in other levels that I had downloaded as well, just not the one that was being reported - the game has since been deleted in its entirety.
What would be the most likely explanation for all this? How would someone have gotten access to my Gmail without leaving any trace? I use my Google account to login/create profiles for different sites, YouTube, Alibaba, Airbnb, so on, but that's really it, and I don't find myself on sketchy domains. I also don't use my Gmail password for any of my other accounts, the password is a standalone - I've since changed my passwords and enabled 2FA on everything.
Any insight would be helpful and greatly appreciated. I'm not completely tech inept but really don't have a very deep understanding into this, and it's been driving me nuts.
Thanks to anyone who decided to read my novel and reach out!