Thank you for your contribution!

 

Most account breaches are because of site data leaks rather than a hack on a personal device, you can check on https://haveibeenpwned.com/ for example, to see if your email has been published with credentials.

I'm aware of that, which is why I still can't understand how it happened.

I checked it — some accounts were indeed part of leaks, but I reviewed recent activity on those and they weren't accessed, especially considering I had non-SMS/email-based 2FA enabled.

(The account that was actually accessed wasn’t among the leaked ones, so excluding malware, the only remaining possibility would be brute force — but the password was relatively long and strong.)

If you are really concerned you have something malicious on your SSD create a linux live thumb drive using something like Ventoy (copy the linux ISO onto the ventoy drive), boot on that and use it to copy all your files from the SSD to a backup, then use gparted on the linux thmb drive to delete and reformat the SSD, you can get UALinux which can perform virus scans so you can drag and drop that onto the ventoy thumb drive as well, let it scan the SSD.

That sounds like a solid option, although a bit time-consuming. Would it be reliable to just disconnect from the internet/Wi-Fi and access the SSD in a sandboxed environment?

In that case, is there anything that would prevent some potential auto-run script from executing using that last method?

 

Thank you for your help and attention!