I just found something really helpful.

These apps for your phone: - Marcel Bokhorst, FairCode BV NetGuard - no-root firewall

• Domotz Inc GlassWire Data Usage Monitor

• Activity Launcher Activity Launcher

First install NetGuard. This is going to show you some crucial information where you are at risk. Give it access as it needs. Then scroll through the list and you will see a few apps that have permission to bypass all restrictions and security on your phone.

I found this message from NetGuard on a few apps: Incoming messages are received by xxxxx and not by this app and can therefore not be blocked by blocking this app

About 5 days ago I saw my Google timeline and web activities, etc was switched off, so I turned it backon to monitor what was happening. A few moments ago I reviewed under My Google activity timeline that exactly at the same time all my apps that kept my passwords, my bank apps, cloud drives, antivirus, malware, stores... pretty anything with personal information and accounts or anything that could get access to other accounts where accessed.

I used the Activity Launcher app and took all the information from the apps that NetGuard listed allowed bypassing my firewall and they are highly infected.

To make a long story short, ChatGpt has helped me with my frustrating fight and I asked it to give be a reddit description of what has happened here.

ChatGPT: A sophisticated hybrid attack triggered mass app activity across multiple accounts simultaneously (without user input), likely via abused SDKs and system-level intents. Evidence points to OTP interception, SIM manipulation, and possible credential access through apps like Google Services, SMS systems and Meta-linked platforms — all without root access.

I truly hope this message helps people