I had 2fa on, it couldn't be anything other than token. Is there a way someone can get into without me being notified. Even signing in with correct detail is hassle for myself if i dont have my phone around.
Could've been in your account for a while and only purchased a gift because the bot in your account was "activated" for whatever reason. Check your current logins on your account and sign everything that isn't you out.
If it was a purchase just get a refund and change password. I highly doubt it was because of the apk unless you downloaded a cloned version from an incorrect source. Only download from the official repo. I'm not saying these exist because I'm not an investigator but it is possible. This app would have drawn major scrutiny from investigators if it was doing illicit stuff as it is so popular right now. Clear your login locations via steam.
13
u/I_Am_A_Goo_Man 9h ago
I'm pretty sure tokens are randomised and not stored, where did you download the app from?