Someone hacked my ebay / paypal and gmail. In gmail they added a rule to delete notifications from ebay / paypal. Then they proceeded to buy $5k worth of mac book airs over the last week. I just noticed because a vendor sent me an email to say thanks for buying so much. They were archiving the transactions in paypal and ebay so they didn’t show up in the default history views.
The scary part is I have 2-factor on gmail, so they must have remoted into one of my systems.
So far ebay and paypal have been very good and are supposedly proceeding to refund the money, but I’ll only believe it once it’s back in my account.
The only avenue I can think the culprits could have used was to remote into a system since I have two factor on gmail.
Could it have been a VNC server client I left on? It was the free version of Real VNC server, with no encryption and a two letter password. I forgot I had briefly opened the port to the internet, and never closed it.
The reason I suspect it is that I am careful with what I open on my systems and always have bitdefender running.
When I looked at the VNC event viewer, it was full of login attempts from unknown IPs. I assume they must have eventually cracked my two letter password and then google sync took care of the rest.
I feel like a moron.
But how likely is this to be how they got in? I know I'll never be able to be 100% sure, but I'm feeling frazzled, exposed and violated.
What else can I / should I do. I've reformatted every computer, requested new Credit Cards and renewed credit monitoring, but I fear there is something else I could do. I've also refreshed all my passwords.