收到ZoHo密码重置成功通知，疑Gmail遭入侵的技术咨询

Hey there, let’s walk through this situation carefully—this is absolutely something to take seriously, since that unsolicited ZoHo password reset success notice points to potential unauthorized access tied to your Gmail. Let’s start with why your suspicion makes sense, then cover how to investigate your Gmail account and secure everything moving forward.

Why your Gmail might be compromised #

ZoHo sends password reset request emails to the linked account (your Gmail) before a reset can happen. Since you never got that request email but got the success notice, it’s likely an attacker accessed your Gmail, deleted the reset request email, then completed the password reset for ZoHo. Even with 2FA enabled, there are ways this could happen—like if they stole your 2FA code via malware, hijacked an active session, or exploited a third-party app with access to your account.

How to check if your Gmail account was hacked #

Follow these steps to dig into your account activity:

• Review recent device logins
  Go to your Google Account (click your profile picture in Gmail > Manage your Google Account), then head to the Security tab. Look for Your devices—this lists every device that’s logged into your account, including location, device type, and login time. If you see a device or location you don’t recognize, that’s a red flag. Also check Recent security activity for unusual login attempts, password changes, or app authorizations.
• Audit third-party app access
  Still in the Security tab, find Third-party apps with account access. This shows every app/service that has permission to interact with your Gmail or Google Account. If you spot any unfamiliar apps (especially those with permissions like "View your emails" or "Manage your account settings"), remove them immediately.
• Check email filters and forwarding rules
  Attackers often set up filters to auto-delete or forward sensitive emails (like password reset requests). In Gmail, go to Settings > Filters and Blocked Addresses to look for any unknown filters. Then check Forwarding and POP/IMAP to make sure there are no unauthorized forwarding addresses linked to your account.
• Search deleted/trash folders
  The attacker might have moved the ZoHo reset request to your Trash or permanently deleted it. Search these folders for terms like "ZoHo", "password reset", or "account verification" to see if there’s any trace of the missing request email.
• Verify your 2FA setup
  Back in the Security tab, go to 2-Step Verification. Check if there are any unfamiliar phone numbers, backup emails, or security keys added to your account. If yes, that means the attacker tried to lock you out of your own account.

Next steps to secure your accounts #

Whether you find clear signs of compromise or just want to be extra safe, take these actions right away:

• Change your Gmail password immediately
  Use a unique, complex password (generated by a password manager is best—mix uppercase, lowercase, numbers, and symbols). Don’t reuse passwords from other accounts.
• Reset your 2FA configuration
  If you found any suspicious changes to your 2FA setup, or even if you didn’t, it’s wise to reset it. Remove all unrecognized verification methods and stick to ones you control (like your personal phone’s SMS/Authenticator app, or a physical security key). For maximum protection, consider enabling Google’s Advanced Protection Program if you qualify—it’s the strictest security tier for high-risk users.
• Secure all linked accounts
  Since your ZoHo account was targeted, go through every other account tied to this Gmail (social media, banking, cloud services, etc.). Change their passwords, enable 2FA if you haven’t already, and check for unusual activity.
• Enable login alerts
  In your Google Account’s Security tab, turn on Login alerts. You’ll get an email or text notification every time a new device logs into your account, so you can spot unauthorized access instantly.
• Scan your devices for malware
  Run a full antivirus scan on your Windows desktop and Android phone. Malware like keyloggers or trojans can steal your passwords and 2FA codes, so removing any malicious software is critical.
• Reach out to Google Support if needed
  If you confirm your account was hacked or can’t resolve certain issues, contact Google’s Account Recovery team to file a compromise report. They can help you regain full control of your account.

Don’t stress too much—taking these steps quickly will go a long way toward locking down your accounts and preventing future problems.

内容的提问来源于stack exchange，提问作者ng.newbie