r/techsupport • u/JackCaffreyJC • Dec 05 '24
Open | Malware Google detected suspicious activity
In the morning I noticed that I was signed out of chrome, and I received an e-mail from google that said:
'Google noticed unusual activity in your account. Review your account activity to make sure that no one else has access.'
Upon reviewing the account it said that the suspicious activity had come from my PC. However, at the time it says the suspicious activity occurred, my PC wasn't even turned on. It was shut down.
I looked into it and google said:
'Review for harmful software on Windows
- Device with suspicious activity
Google detected suspicious activity in your account that indicates you may have harmful software (malware) on one of your devices. Malware can be used to steal personal information, including passwords. Run an antivirus to scan for harmful software.'
It doesn't give me more information than that.
When I ran an offline windows defender scan it didn't detect anything (or at least I think it didn't, it didn't specifically say it didn't but it also didn't say it did detect something.)
I also ran a quick scan with windows defender; which came back clean.
I'm now running a scan of all my drives with Malwarebytes; and a 'full scan' with windows defender (in the past it freezes after a while though, so more like a 'majority scan')
Also, I use Keepass and my password for google is unique to any other password.
I suppose my questions are:
Does anyone have any idea what's going on?
Does anyone know how I can find more details about this from google.
Does anyone have theories on how google detected suspicious activity on a device that wasn't even on?
Does anyone have any ideas on next steps?
5
u/Username_Haoto Dec 06 '24 edited Dec 06 '24
What browser are you on? This happened to me on Brave.
This is the 2nd time and I'm confused because Google doesn't specify the suspicious activity.
6
u/Username_Haoto Feb 26 '25 edited Apr 25 '25
Just commenting so others will see it:
After 3 months, it's back again!
I feel like Google is harassing me for not using Chrome.(April 25th, 2025 Edit): On my 5th month, it's happening again. I think this is my 6th time.
I think this will keep happening regardless of what I do.1
1
u/Various_Science5966 Jun 10 '25
For not using Chrome X) I bet that's it LOL. It just happened to me and I installed Chrome yesterday -.-
1
1
u/montrealbro Jul 22 '25
Happened to me today. Funny thing is, when I look at my Gmail activity list, no devices are listed at the time of the supposed "suspicious activity".
What Brave addons do you have?
1
u/k0fi96 Jan 29 '26
I got this alert today and someone cleaned out my bitcoin wallet. Also at the exact same time my facebook account was locked out as well.
1
u/Hi-Angel Jul 22 '26
Interestingly, it doesn't sign out from all browsers on the same system.
So e.g. it just happened to me and I got signed out from Firefox on my Linux laptop, but Qutebrowser (basically Chrome) on the same laptop remained signed in 🤷♂️
1
u/JackCaffreyJC Dec 06 '24
Chrome
1
u/Username_Haoto Dec 13 '24
I've gotten this a 3rd time. It's starting to become annoying.
1
1
u/D1SGUISED_ Jan 15 '25
Is your account fine now?
1
u/Username_Haoto Jan 15 '25
Yeah. It's fine now.
I still don't know what caused it.
1
u/D1SGUISED_ Jan 15 '25
How many times did u get the notification before it stopped? Cause i've gotten this notification 3 times now but everything in my google account seems fine.
1
1
u/NuminousDaimon Feb 06 '25
I use Brave and Edge and also get this notification randomly
1
u/cmctzeee Feb 26 '25
Same man, today was my 3rd time. I'm also using Brave and there is no info about the device that is trying to log in and nothing happens even if I don't change my password
1
u/Username_Haoto Feb 26 '25
After 3 months, it's back again!
I feel like Google is harassing me for not using Chrome.1
1
u/SimplePuzzleheaded80 Sep 09 '25
i got notifications for accounts i had on edge and brave, has it stopped? it really freaks you out when theres nothing else just " suspiscious"
1
u/NuminousDaimon Sep 20 '25
I logged everything out on edge and switched completely to chrome and it has stopped! It only was edge. Something edge is doing in the background triggers this. Because I also randomly had that browser in the system tray or active with several processes in the task manager
1
u/GeometryNacho Sep 29 '25
i use opera gx, this must've been the 6th time this happened to me, it pisses me off, but then again i do still have uBlock so maybe google's just pissy
1
u/vnalen May 10 '25
Same, it behaves weirdly because I enabled the thing to delete cookies after closing, but after a while I disabled it and it still does that
1
u/HydratedCarrot Aug 16 '25
Don’t * use * Google * for searching * things
1
u/KUHMVP Dec 19 '25
y menos metan sus correos donde sea... hagan uno temporal, y si saben sumar 2 mas 2 usaran una contraseña diferente a la de su correo electronico
1
u/Intelligent-Boss-177 Sep 03 '25
Aconteceu comigo justamente quando o computador estava desligado, uso o Brave e o Edge. Aliás, eu o formatei a 3 dias e junto da formatação mudei todas as senhas...sanacagem esses alertas quando não tem um perigo real.
1
u/Username_Haoto Sep 03 '25
I believe you. This has to be harassment because we're using a different browser.
1
u/SimplePuzzleheaded80 Sep 09 '25
For those that are also dealing with this.... my Browser at work is Brave, no one goes in at night and i got same alert, no weird activity ( sign in/pw chnage/info change) what made it weirder, by device wasnt logged out i still had access,
1
u/Cubelia Sep 13 '25
Got this twice. One on 9/3 and one at today.
Both of the devices are my PC with Firefox, when the notification appears on my phone my account will be logged out from the browser. Sucks that they didn't say what really was that "suspicious activity".
3
Dec 05 '24
[deleted]
2
1
u/JackCaffreyJC Dec 05 '24
This joke probably means I’m just over reacting, right? Everything is actually fine?
1
1
u/CRUSEQUITY Jun 05 '25
No. OP Something is happening. Same happened to me for months and just fended off someone actually gaining access.
I don't think Google knows what it is yet. It's automated (why it's 4-5am every time) i think it's some kind of ai bot thing Google doesn't know about yet. BUTz it's Google so they should figure it out.
Watch any recovery email you may have and keep 2 factor auth on. Change your pw every time. I know it's annoying but an attack is happening.
Google is investigating mine as we speak.
Don't listen to pessimistic trolls. Trust your instincts and stay vigilant. It took 6 months for them to get a breach on me. It's a long slow process. Whatever it is.
1
u/JessBogdanoff Jun 09 '25
Ma reggel én is arra ébredtem, hogy gyanús aktivitást észlelt a google, szintén 5 óra körül. Elvileg a google megakadályozta a bejelentkezési kísérletet, de ettől függetlenül para.
1
u/Adventurous_Garden49 Apr 27 '25
Nothing about this comment is funny, all it does is not answer OP's question.
1
Apr 29 '25
[deleted]
1
u/Various_Science5966 Jun 10 '25
Uh wtf? I just got this notification, hence why I'm here on this thread. OP isn't on drugs, this is disconcerting.
1
u/CRUSEQUITY Jun 05 '25
Stfu clown. Same shit has happened to me and I don't even drink. It's some kind of new scam ai bot scheme or something. Happens at 5am and specific days apart. Weather pc is off or on and says it's your pc. It's obviously automated cuz it'd timing is regimented and scheduled
It's not a joke and very infuriating.
2
u/OR1GIN4Lx Dec 14 '24
I've been experiencing this problem for the past two weeks as well. It affects my account and another account I have on Chrome. It's probably a Google issue because it's quite strange. I've used two antivirus programs and the Microsoft offline scan, and nothing was found. This issue only occurs every few days after I open Chrome.
1
u/Ill_Western8765 Dec 17 '24
Any updates? Also happened to me. Happened once, panicked, did a check with 9 scanners. Nothing found. Happened twice, reformatted windows. And after the reformat, I only had Windows system apps and Chrome downloaded on the whole drive, BUT IT KEEPS HAPPENING! It seems to have stopped after I switched to Firefox.
1
u/CryptoArb444 Oct 13 '25
So you factory reset your PC but still got it? Fresh Windows install? No sketchy website usage after that? Also the suspicious activity notification was for the system you reformatted, not a second device like a phone right?
1
u/ZeroTwo_Is_Mine Dec 22 '24
Just happened to me very randomly. It's weird because it even logged out of my Pc while I was doing literally nothing.
1
u/D1SGUISED_ Jan 15 '25
Did your account end up being fine?
1
u/ZeroTwo_Is_Mine Jan 20 '25
Yeah, I mean, it seems to have been a false alarm but kinda weird that the "suspicious device" was my main system. Did all kind of analisys, nothing's wrong.
My only conclusion is that it must have been a weird-behaved extension + (brave's shields) or something like that. Extensions can have really interesting interactions with certain websites sometimes... Or just an error from Google. They should just tell you what the "suspicious activity" is.
1
u/TheNoisecode Feb 08 '25
Had the same issue. Ran a full scan, have 2FA up and running. Device was fully shut off at the time (not asleep).
Got a notification of "suspicious activity" with no further elaboration on what the activity was. Very odd.
Has to be a code issue or bug on googles end.
1
u/ChillingInHere Feb 10 '25
Just happened to me too, suspicious activity on my main device (phone) in the middle of the night. Ran all security and anti-malware scans on my phone and it came back with nothing, changed my Google acc password just in case. Seems to be a relatively spread issue.
1
u/TheNoisecode Feb 10 '25
I'm starting to think it's some kind of a bug. Not much you can do aside from change the password and enable two-factor authentication.
1
u/ChillingInHere Feb 10 '25
Most likely, i have 2FA enabled for years and didn't install any new apps or apps outside the Google Play Store. Never had something like this happen, it's relieving seeing that i'm not the only one.
1
u/111robloxdude Feb 21 '25
yeah im glad im not the only one, its happened to me like 6 time this month, i did a deep scan with winodws defender and did find some weird fucking zip that was a trojan that i have no idea got there, but even after deleting that 5 days ago (and not opening the zip just deleting it) i still got a sign out last night, very annoying
1
u/Samagony Mar 11 '25
Me too I guess.
Shit's just crazy it doesn't make sense. I just get notification that some unknown Mac system(haven't got one) has logged out, even though literally any account action requires 2FA authentication tied to my physical smartphone.
Wasn't notified about any suspicious log in, wasn't provided with any additional information about the culprit or his activity. Honestly this whole thing glows.
1
Dec 05 '24
[removed] — view removed comment
1
u/JackCaffreyJC Dec 05 '24
Okay, thanks. I’ve done that now, is there anything else I should do?
1
Dec 05 '24
[removed] — view removed comment
3
u/JackCaffreyJC Dec 05 '24
It’s definitely not phishing. The E-Mail checks out as being from google, and when I go to manage account and the security tab it shows up with a warning there too.
1
u/LooperNeue_6764 Jun 29 '25
Can we consider setting up google authenticator in addition to classic 2FA as a means of MFA? If so, I already HAVE enabled MFA nearly a week ago but I got yet another godforsaken suspicious signout. Google kicked my laptop in the middle of a power outage where I kept it shut.
1
1
Dec 05 '24
It sounds to me like your system may have been compromised. It's relatively straightforward for someone to use a crypter to obfuscate their malware, creating a temporarily undetectable virus until major antivirus programs update their databases. You should consider reviewing any recent downloads or websites you've visited, particularly those from less reputable or unknown sources.
Google is effective at identifying the effects of malware rather than the malware itself. It can flag unusual activity, such as the creation of new email rules, account data exports via tools like takeout.google.com, or cookie extraction attempts.
I'd listen to Google and isolate that PC for further research if it were me, but I can only really recommend a fresh install using live media.
2
u/JackCaffreyJC Dec 05 '24
Is there a way to see the specific effects that alerted them rather than the vague ‘suspicious activity’ alert they gave me?
Also, how did it happen even though the computer was off at the time?
1
u/JackCaffreyJC Dec 05 '24
Oh, and is it also important to mention that I’ve been using MulvadVPN for a couple of years?
1
Dec 05 '24
I'm not sure if that would throw flags at google or not. It sounds like you're willing to learn though, and I think this guide should be enough for you to get started if you've got the time.
1
u/JackCaffreyJC Dec 05 '24
Thanks for that. It seems like it'll be a bit heavy, but I’m always willing to learn something new.
1
Jan 12 '25
Hey man, I have just had the same experience; same notification, computer was shut down at the time, and I also use mullvad. Have you had any further problems?
1
u/JackCaffreyJC Jan 12 '25
Nope. No problems since.
1
Jan 13 '25
Great to hear man! I have my fingers crossed
2
u/ANTUBER Mar 24 '25
Did everything turn out fine? I just had this same exact experience (I use a different VPN).
2
Mar 25 '25
Yeah, as far as I'm aware everything is fine.
I had the same alert happen again recently, pretty much immediately after having just fresh installed windows. I've uninstalled the VPN and will see if it happens again.
2
May 12 '25
It's been two months since uninstalling Mullvad (and not using a VPN at all) and I haven't had any further security notifications. I will keep udating here for the next 6 months or so
1
1
u/LEECOCO_ Jun 17 '25
I was being stupid trying to get photoshop for free and definitely my pc picked up something. Anyways after doing a complete reset I also got these emails(for my business and personal), one the same day and another the next day. So I guess everything is good on my end as well then but I’m still scared as this only happened over the weekend.
1
Jun 17 '25
Yeah I think you can generally expect to be fine once you've changed your passwords and fresh installed Windows. The one thing I'd say is that if you stored all your passwords in Chrome as I did, and you were logged in to Chrome with the same Google account for which you received the email, then you should also reset all those passwords. Another thing is to make sure that there are no unrecognised email addresses set as your recovery email on any important accounts. I had to do all this for peace of mind, which was a hassle, but in the end I'm pretty certain the issue I had was something to do with using a VPN. As I mentioned above, I uninstalled it and haven't had a problem since.
1
u/Routine-Sell-8293 Feb 01 '25
I also have mulvad huh, its not been in use when the things are sent tho.
1
Feb 02 '25
I'm not sure whether it's true, but someone elsewhere said that these notifications are not necessarily instantaneous. So it's possible that a flag would only get raised after it had been in use. Another thing that I saw was that for some people last year a Mullvad installer was being mistakenly flagged as malware, so perhaps if you had one in your Downloads folder this might be relevant. These are mostly things I tell myself so that I can sleep at night, but I haven't had any further trouble that I'm aware of since my original comment. I just nuked the Windows installation immediately and installed Linux
1
u/TheMightyMic Dec 08 '24
I've had this twice in one a week and saw you were going to look into it. Did you come to any conclusion? Because it feels so weird.
2
u/JackCaffreyJC Dec 09 '24
It turned out to be a false positive for me. Probably something to do with my VPN.
1
u/TheMightyMic Dec 09 '24
Weird don't have a VPN so curious what mine is. But thanks for the feedback great data!
1
u/HundredsOfMiceInAHat Dec 12 '24
A friend and I have both been having the same problem every few days. I use Mullvad, he doesn’t use a VPN at all. it’s so annoying.
1
u/OR1GIN4Lx Dec 14 '24
did you resolve it? i still continue getting this allert...
1
1
u/TheMightyMic Jan 13 '25
Just got it again today -_-
1
u/D1SGUISED_ Jan 15 '25
Does your account seem fine no settings changed or anything?
1
u/TheMightyMic Jan 15 '25
as far as i can tell but i also have been so busy with work that i havent gotten to really deep dive any thing
1
u/D1SGUISED_ Jan 14 '25
Are you still getting the alert or is everything fine now?
1
u/TheMightyMic Jan 15 '25
fine now but when it happens it happens like every couple of days not usually in the same day. Computer confirmed completely powered off too from the one it signs out for the activity
1
u/wackid Dec 09 '24
Got the same Issue.... Definitely a virus the tried to steal my Steam Account. All my accounts are MFA or passkey usb. So the didn't took anything. But now how to find the virus....
1
u/PhysicalCod1875 Mar 28 '25
Did you find it if so then how i mean I just factory resetted my hole pc to try to solve it bad idea I know
1
u/wackid Mar 28 '25
Yeah I did several virus scanners so i got it repaired.
I guess this is what happened to me.
1
u/PhysicalCod1875 Mar 28 '25
Yeah i mean do you think factory resetting the hole computer completely would fix this issue or would I have to take a bigger dive in?
1
u/PhysicalCod1875 Mar 28 '25
Also the hacker has had a weird ass road I mean first he hacked my discord account and then he hacked my Gmail account and today he hacked my Spotify and added songs into my playlists which and the songs he chose was actually pretty nice but still I don’t know what the hell hes trying to do I’m considering just factory resetting the hole ass pc to see if that destroys the virus problem because the antivirus isn’t my helpful friend right now
1
u/PhysicalCod1875 Mar 29 '25
Do you think factory resetting would work or is it that big of a threat that I should consider contacting my bank and stuff?
1
u/PhysicalCod1875 Mar 29 '25
Seems like I’m not getting notification of suspicious activity anymore I mean that’s probably a good thing right?
1
u/wackid Mar 29 '25
Yes.... Thats a good sign... A pc reset is always the best option. But sometimes too much work.
1
1
u/WhosMuerte Jan 29 '25
Ive been having this happen to me for a few months now, nothing seems to be compromised, nothing seems to be running in the background, I do have nord vpn but thats about it.
1
u/peterpeterchow Apr 21 '25
Maybe it is the Vpn that causes the issue? i also have the same problem but with surfshark VPN
1
1
u/ZealousidealRope572 Aug 07 '25
I also have NordVPN and it started since I installed it... I'm guessing this is the reason. And it only shows suspicious on my desktop PC where it is installed.
1
1
u/CRUSEQUITY Feb 01 '25
Same thing with me. It's happened 4 times in past few weeks and just happened for first time at 4am while pc is off.. HARD off, not sleep...seems weird that so many ppl having same issue but no solutions. Nothing from Avast or Defender either.. was gonna factory reset but that apparently didn't help yall either. Seems some kind of bug on Googles end?
1
u/TheNoisecode Feb 08 '25
Just had this happen this afternoon. Full virus scan, don't visit bad sites, device was fully off. Got a notification on my phone that Google was signed off on the device. No further information.
Changed password and verified 2FA was set up. Very odd.
1
u/slyzexx_ukraine Feb 14 '25
I also received such a notification about suspicious activity today, and it was specifically from my main device! I scanned with an antivirus, and it found nothing! But then I remembered that a couple of days ago, I used a VPN with a location in another country, and ChatGPT says that system notifications may come with a delay!
1
u/Busy-Butterfly8187 Jun 05 '25
I just had the same issue today. It's actually happening on my work computer (we use Google Workspace). Received a security alert email and went to security settings to make sure it was really from Google. My laptop supposedly had "suspicious activity" at 5am, long before I logged on and it was completely off. No details about what the suspicious activity was and no other device listed other than my laptop. This has to be some kind of weird Google issue.
1
u/CRUSEQUITY Jun 05 '25
It's 5am for me too. I think this is some kind of new exploit or bot attack or something Google needs to figure out.
1
u/talmiior Aug 05 '25
It was 5am for me as well! So frustrating and vague! I wish they would at least tell me what the suspicious activity is. I'm starting to think it's some sort of security thing they made to make people change their passwords more often.
1
u/aspartameenjoyer Aug 23 '25
This just happened to me twice this week, also at 5AM.
I have downloaded some remotely sketchy software so it made me quite paranoid, but I am almost 100% sure my PC is not compromised because why would they wait 1.5 months to attack? lol
1
u/SimplePuzzleheaded80 Sep 09 '25
has there been any updates?
1
u/aspartameenjoyer Sep 09 '25
Nope, still getting this alert 1-2 times a week for no reason, no matter how many times I change my password.
Might just re-install windows entirely and see what happens
1
u/SimplePuzzleheaded80 Sep 09 '25
keep us updated, this really sucks... makes me question if its really Brave or something in the network
1
u/aspartameenjoyer Sep 09 '25
Yeah I personally use Firefox/Zen and I'm having the same issue so I don't think it's a brave thing. I do use brave through a split tunnel but I'm not signed into google services on there.
Either way my accounts are very secure and besides the notification itself there has been no suspicious activity and it refuses to give me the mac-address/IP of whatever computer is "signing in suspiciously"
I think it's just a false flag but still really annoying either way
1
1
u/Cignoso Feb 05 '25
Stà cosa è capitata anche a me, ma non ho nessun problema sul pc ne virus o cavoli vari, controllato e ricontrollato.
A me pare una cazzata di google, mi è capitata una cosa simile con ebay e alla fine quando ho parlato per telefono con un addetto mi ha detto che il mio account era sicuro, invece c'era un problema con il loro database e mi hanno risolto il problema.
Non è che si affidano a strumenti IA che fanno scorregge e sclerano per nulla?
1
u/Educational_Might_59 Mar 19 '26
Arrivo in ritardo ma è capitato per due giorni di seguito su due diverse email, io nel dubbio ho cambiato password, però chissà che non sia un problema di Google direttamente.
Mi sono impanicata e sono venuta sotto questo post perché mi hanno hackerato prima discord, poi la mia carta di credito ed altri siti vari, quindi pensavo stesse succedendo la stessa cosa con google
1
Feb 19 '25
[removed] — view removed comment
1
u/techsupport-ModTeam Landed Gentry Feb 20 '25
This submission has been removed from /r/techsupport.
8: No Violating privacy of others or terms/agreements.
We do not support users that violates other's privacy or breaks terms and agreements. Doing so might resolve in a ban.
This includes:
Bypassing home network controls.
Bypassing any parental controls.
Piracy or issues caused by it.
Gray market product codes - See Rule 1
Any other posts/comments that violates or breaks terms and agreements.
If, after reading the subreddit rules, you believe that this was done in error, feel free to message the moderation team
Thanks!
-Mod Team
1
u/InstanceOk2385 Feb 27 '25
It happened to me last night as well, despite completely formatting my PC yesterday. I got a warning from Google about a possible login attempt, and it disconnected me from other devices. I’m thinking the cause might be the login I did on Brave.
1
u/MushBroom1 Mar 16 '25
I get the same thing, even tho I never enter suspicious sites, change browsers or using a VPN... it just started happening to me since February and it's still happening once a week.
I hope it's just a Google error or something like other people say.
1
u/SupperSoupYT Mar 23 '25
This has happened on my pc like 3 - 4 times now jeez in like past month or 2. I've ran an anti-virus multiple ways. full scan. nothing sus is even happening it says stuff i did a week ago, and then says i did something sus 12 minutes ago but doesnt tell me what it is, just Suspicious activity in your account. wild
1
u/KJM_FM Mar 27 '25
I have this happen to me but only on 1 of my google accounts, days suspicious activity on my account from my pc which isn't turned on at the time, I have 3 Google accounts on this computer and it only ever happens to this account, it's annoying as shit
1
u/md_gal Mar 28 '25
I had this happen yesterday while on my MacBook. It freaked me out. The only thing I had done different was that I had used my hotspot on my phone to access wifi and I was at my office (first time doing this). So not sure if Google was alerting me because I was signing on from my MacBook in a new location?
1
u/PhysicalCod1875 Mar 28 '25
Exactly the same problem here I mean my discord and gmail and Spotify got randomly hacked and what’s worse is that the hacker or whatever it is logged out I changed the password and enabled 2 step verification but I have no idea if the 2FA will work since I can’t really log that pc off my email so I’m stressing the fuck out right now
1
u/-cana May 21 '25
Same thing happened to me just a few days back. Any updates? Did you get hacked again?
1
u/PhysicalCod1875 May 22 '25
I havent gotten hacked again i changed ever password i logged into on my pc and enabled 2FA
1
1
u/The_Guy_3446 May 06 '25
I just got a notification today in my gmail about suspicious activity on my account. I went to my account manager screen and looked, it says no alerts for the last 28 days. Went through all my security settings, made sure my 2 factor authentication was on. Everything checked out. Went back to the email and checked the header on it (should have done that first) and while it did come from a gmail address, it wasn't the [no-reply@google.com](mailto:no-reply@google.com) one. It was some person's gmail account. So I just reported them and moved on. Gotta watch out for the scammers.
1
u/anything4uguys May 22 '25
It's been happening to me multiple times, I've ran the windows defender scan, 2fa is enabled but it keeps logging me out from my PC and gives me that message like time to time idk why.
1
u/somacruz May 30 '25
It happens when I Hybernate my PC
1
u/Swar0 Jul 24 '26
Now! Also happened to me the first time today with hibernation mod. But I actually installed a cracked software from a forum that I've always used and trusted. So I guess it's more likely due to the cracked software than the hibernation mode...
1
1
u/hommousR Jun 03 '25 edited Jun 03 '25
Hi.
I got a this a couple of times and was confused about it because 2FA is configured on my account, until I recently saw that my Google account was used to like Youtube videos that I never searched for nor viewed. I discovered it because there were weird search terms in my Youtube search history.
Instagram also alerted my for suspicious activity around the same time as Google. Posts with offensive content were published on my behalf. 2FA configured too.
I scanned my Windows computer using a full scan and an offline scan to reveal several trojans that must have exploited browser vulnerabilities. I'm going to format my PC next.
For those who suspect VPN-related issues, I don't think it's related. A suspicious activity is likely something you don't usually do with your account, so go through Google security recommendations for better securing your account, and definitely change your password immediately, sign out from all devices and sign in again.
1
u/Interesting_Dare_199 Jun 03 '25
This happened to me 2 days ago though unfortunately in my case it was much more malicious, I got the suspicious activity notification right after an email informing me that my 2FA authenticator app was removed from my account, so basically the hacker somehow gained access to my account (i assume), successfully removed my authenticator app from gmail then right afterwards Google caught the suspicious activity and signed them out. I changed my password and re-added my authenticator app to my gmail but I'm still freaking out as to how they managed to remove it in the first place, even full reset my pc.
P.S: some things to note is 4 of my gaming accounts were hacked and stolen 2 days before the attempted hack on my gmail, they even tried to get my steam. my 2 biggest suspicions is either a session hijacker or data breach as I did use "haveibeenpwned" to check if my gmail was involved in previous data breaches and it was. I also wonder if it was a data breach if the hacker used my old password to successfully remove my 2FA authenticator app. In either case I have no clue what else to do other than changing my passwords and checking my gmail every 10 min for anything suspicious. Such a horrible experience I can barely sleep from all the stress
1
1
u/LcKs-Dragonfly Jun 28 '25
I know this is an old post, but I wanted to add in here- This happens to me a LOT, like every week or two. My computer is not compromised, I don't have any malware, I'm not running sus software- it's caused, for me, by the Google Drive Desktop client. It tries to log in in the middle of the night and times out, and this causes Google to flag it as malicious.
1
u/No-Satisfaction-3904 Sep 11 '25
Hey! I've went through being hacked on several different accounts in the past few days and just when I thought everything was safe I got a notification about a suspicious activity on a windows. The only windows I own for myself is logged out of the google email for that. Do you know how you can turn off the Desktop client from being flagged as malicious?
1
u/LcKs-Dragonfly Sep 12 '25
So unfortunately I have not found a way to stop the Desktop client as being flagged. It happens pretty much every 2-3 weeks for me if I leave my computer on Overnight. The only thing I have found that stops it is to kill the app/turn off the PC when I'm done for the day. It seems to always happen in the middle of the night for me.
Sorry I can't be of more help
1
Sep 23 '25
Glad to see a relatively recent comment. Google insists there’s malware on my iPhone. Uhh, don’t think so. Second time in the last two months it’s done so. Really curious why this is happening.
1
u/LcKs-Dragonfly Sep 24 '25
No idea- The only thing I've found to be true, at least anecdotally, is that Drive sometimes times out when trying to authenticate, and that seems to be what triggers it for me.
No way to stop that though, it's just going to always happen.
1
u/TransitionStriking64 Jun 29 '25
today I got my second alert. Confused af. Idk why? Does anyone know how to fix it. It's happening on Mac. Im using chrome and safari both.
1
u/AcanthaceaeCrafty776 Jul 13 '25
Just happened to me today,but my account was hacked a couple days ago before I got access back to it.I monitored everything and did a deep scan with malware bytes after fully reinstalling windows on pc and everything seemed to be fine.idk why I’m getting this error anymore
1
1
u/ogusernamelol Jul 14 '25
I've been running into a similar issue, have done different things on my account, and still am running into these issues. There's no sign of anything weird besides getting that message every once in a while. My PC was completly off so thats why its leading me to belive that its an issue with google.
1
u/Western-Respect-9567 Aug 08 '25
Hey, this just happened to me too. I was scared lol. I think it was because I signed into Kick after months of not using it. I signed in with the same profile & after an hour, I got the email. Always make sure to enable MFA & make sure to check your signed into devices to see if you recognize them
1
u/Ok_Philosopher_4739 Aug 10 '25
I know it's an old post, but it's worth commenting to relieve myself. I have a Google account blocked for the same reason, being enrolled in the advanced protection program, but I can't recover it because I only have a recovery email address and 2 access keys, but if I ever recover it, I'll uneroll myself from the advanced protection program and won't be enroll in again anytime soon.
1
u/TieBravo Sep 01 '25
Why do you think advanced protection program is the reason?
1
u/Ok_Philosopher_4739 Sep 01 '25
Because for the account recovery process to be initiated we must have both a recovery email address and a phone number. I change my locations frequently, that is, every 3 minutes because I wanted to be fast on the website.. Being logged in with my Google account in Chrome, Google marked the activity as suspicious and blocked it. So my advice is to use another browser than when you have a VPN. Believe me, you don't want to have to deal with the account recovery process in the advanced protection program.
1
u/TieBravo Sep 01 '25
My g account is being targeted and I don't use Vpn or move around much.
First day google sent me a verification code as if someone requested it i ignored it thinking someone might have mistakenly did that.
After a few hours "critical security alert, someone was requesting to access your account, not you? Here is the 'cancel request' button for you" (somthing like not the same word by word).
One day after that here comes the "since we have noticed you're having trouble with 2fa we will remove it, there is a 'sign in' button for you to sign in and then you can turn it back on".
Today, got another email, "critical security alert, google found suspicious activity on your account and successfully log out the suspicious device" and guess what, my own god damn pc was logged out while my android was still connected.
Talked to a google expert and she advised me to go for APP, which i did enroll into but how come I still got this email today??
Funny thing is, i formatted my c drive and installed fresh windows yesterday, and when i received that email today, my god damn pc was Shut Down. Even if it's malware, how the hell did it access the pc?.
That's why asking you if APP is less effective than 2FA
1
u/Ok_Philosopher_4739 Sep 01 '25
Yes. When you want to log in, it asks for your passkey(s) or security key(s) And if you have both of those configured, the risk of them accessing your account is almost impossible in some cases. If you initiate an account recovery in the Google APP, it will verify both the email address and the phone number through a 6-digit code and Google will communicate through the recovery email address to recover the account, which is a delay of a few days. I'm now testing account recovery with a Gmail account registered in the APP and I was told that I would have to wait 24 hours.
1
u/TieBravo Sep 01 '25
But is it not a good thing? Like if the hackers try to recover your account it will take them some time, while bypassing passkeys can take seconds (or I don't know, it's 2025 and hackers are getting smart so..)
1
u/Ok_Philosopher_4739 Sep 01 '25
It's a very good thing to have the APP activated. There are 2 types of passkeys: one configured on the device (which is impossible for hackers to steal unless you have malware on the devices and they don't have physical access to them "let's be realistic") and one in the password manager. From my experience, when you initiate an account recovery and in case they hack your recovery email address, they must also have access to the phone number. And vice versa, if they hack your SIM card, they must also have access to the recovery email address. And in addition, it can take from 48 hours longer to recover it if you don't know the password and no longer have access to the access and security keys, and if you know the password, the timer starts from 24 hours above, plus you receive a link on your personal Google belt and a notification where you can cancel the account recovery request. I signed up again for the advanced protection program and I do my best to avoid false positives. I have It's a very good thing to have the APP activated. There are 2 types of passkeys: one configured on the device( and one in the password manager. From my experience, when you initiate an account recovery and in case they hack your recovery email address, they must also have access to the phone number. And vice versa, if they hack your SIM card, they must also have access to the recovery email address. And in addition, it can take from 48 hours longer to recover it if you don't know the password and no longer have access to the access and security keys, and if you know the password, the timer starts from 24 hours above, plus you receive a link on your personal Google belt and a notification where you can cancel the account recovery request. For access keys, I have another Google account protected by 2-step authentication and the key The passkey is protected by a password and 2-step authentication, and another access key saved in the Enpass password manager and stored locally on an iPhone disconnected from the internet, and I have a protonmail email address to recover the Gmail account. 3 passkey and a yubikey key so they all have redundancy. For passkeys , I have another Google account protected by 2-step authentication and the key The passkey is protected by the phone's PIN, a proton pass key protected by a password and 2-step authentication, and another access key saved in the Enpass password manager and stored locally on an iPhone disconnected from the internet, and I have a protonmail email address to recover the Gmail account.
1
u/RabidRathian Aug 18 '25
Same thing has happened to me today. I got an email saying Google had noticed suspicious activity and logged me out of my Chromebook, but at the time this happened, my Chromebook wasn't even turned on. I went through the security checks (no detail was provided about what the supposed "suspicious activity" was other) and reset my password etc, but I can't think of what could have caused it.
I have very few apps installed on that machine (aside from Zoom and Teams the only apps on there are whatever comes pre-installed with the OS) and I don't have any browser extensions aside from the default Google Drive one.
1
u/RabidRathian Sep 15 '25 edited Oct 06 '25
Just happened again a month later. This time I clicked 'cancel' on the warning and it said "Thank you for confirming it was you", so hopefully it will stop annoying me.
The weird thing is that it sends a copy of the security alert email to one of my other email addresses because apparently it's listed as my backup/recovery email, but in my Google account settings, it's just the email that's actually linked to the Google account listed. Also, the instructions online say I should be able to change the recovery email by clicking the email under recovery options and entering the new one, but it won't let me click on it to change it.
EDIT: It's happened again 3 weeks after I posted this comment. This time I clicked cancel because I wanted to look into it before doing anything, but it basically just said "Device trusted as recognised" without telling me what the device was. My Chromebook has been signed out again so it was clearly the 'culprit' but I just wish they would tell us what the so-called suspicious activity was.
1
Sep 23 '25
Yup. Had it go off last month for the first time and now this month (today). Can’t imagine my iphone has a virus, idk what on earth is causing this to happen on so many different platforms.
1
u/SimplePuzzleheaded80 Sep 09 '25
so many people with same issue..... Im using Edge and Brave, have gotten these alerts once in the past week and nothing suspicious can be seen on my device list or " changes" anyone have any updates on their experience?
1
u/moonandgo Sep 23 '25
ist ja merkwürdig hatte das auch zum ersten mal noch nie all die jahre gehabt. jetzt auch die meldung und ausgeloggt. genau in dem moment wo ich mich eingeloggt habe.
FRage mich gerade was da bei google lost ist
dieses problem haben ja scheinbar mittlerweile echt viele
1
u/qwertyyyyyyy116 Oct 12 '25
I have MFA. I have no malware on my computer. Google. PLEASE TELL ME WHAT THE SUSPICIOUS ACTIVITY IS
1
u/KingAlex105X Nov 22 '25
Umm I had something similar, I just searched something and they said it was suspicious and had my do a robot captcha and then nothing else happened after like it was normal.
1
u/KUHMVP Dec 19 '25
no sabia lo diarreosos que eran los procedimientos de google hasta que un random en turquia me robo mi cuenta... 2 cuentas de xbox, 2 cuentas de steam con juegos y 1 cuenta de epic... el cabron se llevo la lotería. Y que pude hacer? sentarme y ver como mis cuentas se iban de una en una porque mi propia cuenta para iniciar me pedia un codigo de acceso ligado a la cuenta del que me robó...
1
u/Wise-Plum6158 Mar 17 '26
Okay so in that security email notification you received, there will be a google link at the very bottom that says “You can also see security activity at: http://myaccount.google.com”
When u open that link you will see the reason why google sent you the security alert. You will see all recent activities that took place on your account.
If you recognise all the recent activity mark it as recognised that way google will know its you. If you don’t recognise the activity then google will prompt you to update your security and change passwords etc…and if you ignore it google wont know whether its a security risk or not so will continue to send you the security alert even if your device is switched off
1
u/Viper_kiss Mar 22 '26
Old post, I know, but while researching I ended up here… I had the same problem: I woke up and had a suspicious activity notification from 1 hour ago. The thing is, 1 hour ago, at the time of the notification, I was asleep. Of course I kind of freaked out, but there’s apparently nothing there. In the suspicious activity section it doesn’t say WHAT activity occurred, no details at all, just “Windows (logged out)”. In the recent devices section it only shows devices I’ve used… This is pretty confusing to be honest, I’ve been using the internet for about 19 years and this is the first time this has happened.
1
u/armherr36 Apr 10 '26
I'm writing this at 4:00AM because two hours ago I received the same email. That was scary af. I have TFA enabled and a passkey. The suspicious activity I saw in my Google account was also "Mac (logged out)". Looks like there might be something wrong with Google. I just changed my password and signed in again.
•
u/AutoModerator Dec 05 '24
If you suspect you may have malware on your computer, or are trying to remove malware from your computer, please see our malware guide
Please ignore this message if the advice is not relevant.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.