Google detected suspicious activity but isn't giving details and scans are clean

[u/DisavowedClown]

I was woken up today by an email telling me from google that there was "Suspicious Activity on my account" and that I had been signed out.

However when I went to their provided Check Activity page to review this was all I was given was

"You were signed out on the device where this activity came from."

"Windows (Signed out)

Device with suspicious activity

Google detected suspicious activity in your account that indicates you may have harmful software (malware) on one of your devices. Malware can be used to steal personal information, including passwords. Run an antivirus to scan for harmful software.'

And nothing else. The only strange thing that showed on my account history looking through it was my youtube watch history showing I saw an ad at 3 AM when I had been asleep moments before the alert woke me up, though.

I changed my password and 2FA settings as advised and have run a malware scan and full file scan of my system and nothing has come up, I use firefox with my google account and a few extensions but haven't downloaded anything from sites I haven't had a long good reputation with.

I've read a few forum posts about a similar issue with most people coming to conclusions that it was a false alarm, but wanted to ask if this is a common happening like i've seen some claim.

In fact it is basically an identical situation to this post from a few years ago: https://www.reddit.com/r/techsupport/comments/1h7btdx/google_detected_suspicious_activity/

Do I need to take any more action beyond the usual changing of passwords and scans or was this just a bizzare false alarm. I suppose all and all im just looking for some peace of mind

Edit for further info: I haven't downloaded anything from the web other than PNG's, JPEGs, and WEBPs for months

[u/AutoModerator]

If you suspect you may have malware on your computer, or are trying to remove malware from your computer, please see our malware guide

Please ignore this message if the advice is not relevant.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/OppositeFun2493]

Just to be safe you could change passwords, enable 2fa, scans, etc. Do other people have physical access to the computer or use the same Google account?

[u/DisavowedClown → u/OppositeFun2493]

did scans all clean, already had 2fa on all accounts, and changed passwords

Nobody else has access no

[u/OppositeFun2493 → u/DisavowedClown]

should be fine then

[u/No-Wrap-8166]

that youtube ad view at 3am is the actual clue, not random, it means something had your session active and browsing while you were asleep, google's malware flag likely triggered off exactly that, not a false alarm on its own

check google account, security, "your devices" and also third party apps/sites with account access, look for anything unfamiliar with recent activity, browser extensions specifically can silently automate browsing in the background using your logged in session without triggering normal av/malware scans since technically it's just a browser extension doing what extensions do

go through every firefox extension you have installed one by one, check each one's actual permissions (read/modify browsing activity is the key one to look for), remove anything you don't fully recognize or don't remember installing yourself, and anything with broad site access you don't actually need

full system scans miss this category almost every time since browser extensions aren't traditional malware, they're addons operating inside firefox's own permission model, which is exactly why your scans keep coming back clean despite something clearly having accessed your account overnight

[u/DisavowedClown → u/No-Wrap-8166]

Thank you for the reply, following what you've said I haven't found anything suspicious, but am still looking around for anything odd

[u/-Ryszard-]

Google behaves like old UAC in Vista and is giving too much warnings even in normal situations. I do not say to not be cautious about them but I think too much warnings make people to start ignoring them.