Interactive Troubleshooter

Published: Oct 16, 2026

Google Account Suspicious Activity? How to Check for Unknown Devices

Time: 15 mins Level: Beginner

By StepDiag Engineering Team

Reviewed by Ibraheem Taofeeq Opeyemi

Exhaustive troubleshooting tree to audit active Google account sessions, identify unknown or compromised devices, revoke malicious OAuth API access, and secure account credentials.

Full Diagnostic Tree & Step-by-Step Overview

What specific security warning or suspicious device indicator prompted you to check your Google account?

I received an official security alert email from Google warning of a new sign-in from an unknown device
I noticed unrecognized devices listed under my signed-in hardware sessions in account settings
My account exhibits strange behavior, such as sent emails I didn't write or altered security settings
Third-party apps or websites are accessing my Google data without my explicit recent permission

What details are displayed when you inspect the sign-in alert or security activity log?

An unfamiliar operating system, browser, or geographic location appears in the recent security log
The alert indicates a successful sign-in via an OAuth token or saved session cookie rather than a password
Multiple failed brute-force sign-in attempts from international IP addresses appear in the activity history
The security alert was a false positive triggered by a VPN, proxy, or newly updated browser profile

What happens when you attempt to sign out an unrecognized device from the active sessions list?

The device disappears from the list, but reappears or reconnects shortly after
The sign-out button is unresponsive, or error messages prevent session termination
The device is successfully removed, but you notice unauthorized changes to your recovery info

What type of unauthorized account modification or altered artifact do you discover upon investigation?

Gmail forwarding rules or filter configurations redirecting mail to external addresses
New recovery phone numbers or backup email addresses added without your authorization

Where are the unauthorized application connections located within your Google ecosystem?

Listed under third-party apps with access to your Google account data via API tokens
Embedded browser extensions or script injections running inside your desktop Chrome profile

Auditing Google Security Activity Logs and Terminating Unfamiliar Sessions

Solution:

Root Cause: Unauthorized Credential Harvesting or Stolen Password Access

When an unknown device appears in your Google security logs with an unfamiliar operating system or geographical location, it indicates that an unauthorized party has acquired your password or bypassed multi-factor authentication to establish an active authenticated session.

Diagnostic Verification:

1Navigate to your Google Account Security dashboard (myaccount.google.com/security).

2Locate the Your devices section and click Manage all devices to view a comprehensive itemized list of all hardware currently maintaining an active login token.

Step-by-Step Fix:

1Identify Unrecognized Hardware:

Review each device entry, noting the OS, last active IP address, and location.

2Revoke Device Access:

Click on any unfamiliar device, then click the Sign out button to immediately invalidate its OAuth session tokens.

3Change Master Password:

Immediately update your Google account password to a strong, unique alphanumeric passphrase.

4Enable Enhanced Security:

Ensure 2-Step Verification is active and add a physical passkey or authenticator app.

Prevention & Long-Term Monitoring:

Check your signed-in devices list monthly and review Google Security Alert emails immediately.

Mitigating Session Hijacking and Stolen Cookie Persistence

Solution:

Root Cause: Infostealer Malware and Session Cookie Theft

Advanced attackers bypass passwords and 2FA entirely by deploying infostealer malware (such as RedLine or Racoon stealer) onto your computer to harvest active browser session cookies from Chrome, Edge, or Firefox. Even if you change your password, the attacker retains persistence until active sessions are globally revoked.

Diagnostic Verification:

Check if recent sign-in logs show successful access without 2FA challenge prompts, indicating cookie injection rather than standard credential entry.

Step-by-Step Fix:

1Scan for Malware:

Run an offline full system malware scan using Windows Defender, Malwarebytes, or a trusted antivirus utility to eradicate infostealer payloads.

2Force Global Sign-Out:

Go to Google Account Security > Manage all devices and sign out of all active web and mobile sessions.

3Clear Browser Data and Credentials:

In your web browser settings, clear all cached cookies, site data, and stored autofill passwords.

4Re-authenticate Securely:

Log back in manually using your updated credentials and fresh 2FA prompts.

Prevention & Long-Term Monitoring:

Never download cracked software, pirated game mods, or unverified executables from untrusted web sources.

Analyzing Brute-Force Activity and Securing Account Perimeters

Solution:

Root Cause: Automated Credential Stuffing Attacks

Automated botnets frequently test leaked username and password combinations across Google login endpoints. While these attempts usually fail if 2FA is enabled, they generate numerous warning notifications in your recent security activity log.

Diagnostic Verification:

Review the Recent security activity panel in your Google Account security settings for repeated 'Sign-in blocked' or 'Incorrect password' entries from foreign IP ranges.

Step-by-Step Fix:

1Verify 2FA Enforcement:

Confirm that 2-Step Verification is toggled ON and that backup phone numbers are secure.

2Update Primary Login Email Alias:

Consider adding a secure alternate sign-in email address and removing login permissions from old, leaked primary email addresses if necessary.

3Review Connected Services:

Ensure no unauthorized recovery methods were added during the brute-force window.

Prevention & Long-Term Monitoring:

Never reuse passwords across multiple online services or forums.

Differentiating VPN Routing and False Positive Location Alerts

Solution:

Root Cause: VPN Tunneling or ISP Dynamic IP Geolocation Discrepancies

Security alerts warning of a 'New sign-in from [Foreign Country]' are frequently false positives triggered when you browse while connected to a Virtual Private Network (VPN), proxy server, or when your mobile carrier assigns a dynamic IP address routed through a distant regional gateway.

Diagnostic Verification:

Compare the IP address and device name listed in the security alert with your active VPN server location or current mobile network connection.

Step-by-Step Fix:

1Cross-Reference Connection Details:

Verify if the device model, operating system, and browser match your personal hardware.

2Confirm VPN Activity:

Acknowledge the alert as 'Yes, it was me' if the sign-in timestamp coincides with your active VPN session.

3Secure Account If Unsure:

If there is any lingering doubt regarding device legitimacy, sign out the session and change your password as a precaution.

Prevention & Long-Term Monitoring:

Keep track of your active VPN node locations to avoid misinterpreting internal security warnings.

Breaking Persistent Session Loops via Global OAuth Token Revocation

Solution:

Root Cause: Active Rogue OAuth App Tokens Maintaining Persistent Reconnections

If an unknown device reappears immediately after you sign it out, the attacker has likely registered a persistent API application or OAuth token that automatically re-establishes a valid session cookie in the background without needing your password.

Diagnostic Verification:

Go to myaccount.google.com/permissions and inspect all third-party apps and services connected to your Google profile.

Step-by-Step Fix:

1Revoke All Third-Party App Permissions:

Click on every unfamiliar application or extension listed under connected apps and select Remove access.

2Force Global Password Reset:

Change your Google account password immediately after purging app tokens.

3Terminate All Sessions Again:

Return to the devices list and sign out all active hardware connections once more.

Prevention & Long-Term Monitoring:

Periodically audit your connected third-party app permissions dashboard.

Troubleshooting Responsive Web Dashboard Failures and Browser Caches

Solution:

Root Cause: Corrupted Browser Cache Preventing Google Security Dashboard API Calls

When web dashboard controls fail to respond or throw errors while trying to sign out devices, local browser cache corruption or aggressive ad-blockers are usually blocking JavaScript execution on Google's security management endpoints.

Diagnostic Verification:

Open an Incognito / Private browsing window, log into your Google Account, and attempt to sign out the device again. If successful, local browser cache was interfering.

Step-by-Step Fix:

1Clear Browser Cache and Cookies:

Press Ctrl + Shift + Delete in your desktop browser, select cached images and files, and click Clear data.

2Disable Extension Blockers:

Temporarily disable aggressive script blockers or VPN browser extensions that interfere with Google authentication scripts.

3Use Alternate Device or App:

Manage your account security settings using the Google One or Gmail mobile app on a verified smartphone.

Prevention & Long-Term Monitoring:

Keep your web browser updated to the latest stable release to ensure secure API communication.

Reclaiming Compromised Recovery Information and Security Aliases

Solution:

Root Cause: Unauthorized Modification of Account Recovery Phone and Email

If an attacker gained entry and modified your recovery phone number or alternate email address, they can intercept future password resets and maintain backdoor access even after you revoke device sessions.

Diagnostic Verification:

Go to myaccount.google.com/personal-info and inspect your contact info (Email and Phone number) for unauthorized modifications.

Step-by-Step Fix:

1Remove Unauthorized Recovery Info:

Delete any unfamiliar phone numbers or backup email addresses added by the attacker.

2Restore Legitimate Contact Details:

Input your verified personal phone number and secure backup email address.

3Secure Recovery Channels:

Enable Google Prompt verification on your primary smartphone to supersede SMS-based recovery.

Prevention & Long-Term Monitoring:

Verify your contact recovery settings quarterly to ensure no unauthorized changes went unnoticed.

Purging Unauthorized Gmail Forwarding Rules and Hidden Filters

Solution:

Root Cause: Mail Exfiltration via Automated Gmail Filters and Forwarding Rules

Compromised accounts are frequently used to spam contacts or siphon sensitive financial correspondence. Attackers establish hidden forwarding rules and filter criteria under Gmail settings so incoming messages are instantly forwarded and archived without leaving visible traces in your primary inbox.

Diagnostic Verification:

Open Gmail on the web, click the Gear icon > See all settings > Navigate to the Forwarding and POP/IMAP and Filters and Blocked Addresses tabs.

Step-by-Step Fix:

1Disable Unauthorized Forwarding:

In the Forwarding and POP/IMAP tab, ensure forwarding is disabled or remove any unfamiliar destination email address.

2Delete Malicious Filters:

Go to the Filters and Blocked Addresses tab, select all suspicious automated filter rules created by the attacker, and click Delete.

3Check Delegated Accounts:

Go to Accounts and Import > Check Grant access to your account and remove any unauthorized user delegates.

Prevention & Long-Term Monitoring:

Audit your Gmail forwarding rules and filter settings whenever you receive a security alert.

Restoring Account Ownership After Recovery Contact Hijacking

Solution:

Root Cause: Complete Account Lockout via Altered Recovery Credentials

If an attacker changed your password and locked down your recovery phone and email, standard automated password recovery options will fail, routing verification codes directly to the hacker's devices.

Diagnostic Verification:

Attempting account recovery displays verification prompts directed to unknown phone numbers or email addresses.

Step-by-Step Fix:

1Initiate Google Account Recovery Page:

Go to the official Google Account Recovery portal (g.co/recover) using a trusted device or browser where you were previously logged in.

2Answer Security Prompts:

Answer historical security questions, provide previous passwords when prompted, and use familiar Wi-Fi networks to help Google verify ownership.

3Submit Recovery Request:

If 2FA codes are blocked, select Try another way until you reach the option to submit a support ticket with a secure alternate email for manual review.

Prevention & Long-Term Monitoring:

Revoking Rogue Third-Party API Access Tokens and App Connections

Solution:

Root Cause: Malicious Third-Party App OAuth Integration

Users often authorize third-party website utilities, games, or browser tools by clicking 'Sign in with Google'. If a malicious app is granted access, it retains continuous read/write permissions to your Google Drive, Gmail, or Photos data even after your password is changed.

Diagnostic Verification:

Go to myaccount.google.com/permissions to review all applications and services permitted to access your Google account data.

Step-by-Step Fix:

1Audit Third-Party Permissions:

Examine the scope of access granted to each application (e.g., 'Full access to your Google Account').

2Remove Unauthorized Apps:

Click on any unfamiliar app, game, or web service and click Remove access.

3Secure Account API Access:

Ensure only trusted applications (like official mobile OS integrations) maintain active tokens.

Prevention & Long-Term Monitoring:

Review your third-party app permissions list every six months and remove unused integrations.

Cleaning Malicious Browser Extensions and Script Injections

Solution:

Root Cause: Compromised Browser Extensions Injecting Malicious Scripts

Malicious or hijacked browser extensions installed on desktop browsers can monitor your browsing sessions, inject code into web forms, and capture active session cookies or authentication tokens directly from memory.

Diagnostic Verification:

Open your desktop browser extension manager (chrome://extensions or equivalent) and review all installed add-ons for unfamiliar or unverified tools.

Step-by-Step Fix:

1Remove Unfamiliar Extensions:

Immediately click Remove or Uninstall on any browser extension you did not manually install or do not recognize.

2Reset Browser Settings:

Go to browser settings > Reset settings > Restore settings to their original defaults to clear modified search engines and injected scripts.

3Perform Antivirus Scan:

Run a thorough malware scan to ensure no persistent host-level adware or extension droppers remain active.

Prevention & Long-Term Monitoring:

Only install browser extensions from official web stores and verify developer credibility before adding them.

Related Diagnostic Guides

Printer Driver Is Unavailable Windows 11: Driver Store Cleanup Fix

SD Card Reader Not Working After Update: Realtek Driver Tree

USB C Hub Not Detecting HDMI: DP Alt Mode Diagnostic

Laptop Touchpad Not Working After Windows Update: Precision Driver Tree

MEMORY_MANAGEMENT BSOD While Gaming: XMP Profile Diagnostic

Subscribe to StepDiag

Embed Guide on Your Website