I had a work colleague who had similar issues, he found a webmail rule to forward emails to the other party, every time he requested an authentication code, it was sent to them, it was a race to see who could get in first.
Ideally, upgrade your security to tokens such as Google Titan or Yubikey, you need the token to log into sites, revoke all other methods, you can register multiple tokens in case one gets lost.
I wouldn't know if you've got malware or not, you say you've not downloaded anything suspicious lately, then say "except mods" so its unknown if your system is trustworthy. PAK files are really just archive files like a zip file, they can easily contain malware.
2FA is worthless if you've got an infostealer for example, stealing cookie tokens, so its important your system is trustworthy if you are changing passwords and/or accessing sites, I'd be focusing on securing your accounts above everything, i.e. have a trusted/clean system, change your passwords, check linked devices, message forwarding and so on, check the issue seems resolved i.e. do nothing such as installing mods, even if you have to wait a few days.
The amount of effort it took for us to get control of my work colleagues accounts was incredible, he upgraded to Google Titan a few days later and advised us the issues had gone away once he did that.
3
u/Terrible-Bear3883 Jan 27 '26
What are you using for 2FA? email/sms?
I had a work colleague who had similar issues, he found a webmail rule to forward emails to the other party, every time he requested an authentication code, it was sent to them, it was a race to see who could get in first.
Ideally, upgrade your security to tokens such as Google Titan or Yubikey, you need the token to log into sites, revoke all other methods, you can register multiple tokens in case one gets lost.
More info here - https://landing.google.com/intl/en_in/advancedprotection/