I woke up this morning to several new labels in my gmail to delete all emails for "bank" "card" "paypal" etc, and paypal was hacked with purchases. But my gmai

I woke up this morning to several new labels in my gmail to delete all emails for "bank" "card" "paypal" etc, and paypal was hacked with purchases. But my gmail has zero new logins, my 2fa wasn't triggered, etc. How does a hacker create labels to delete my email but not register a login attempt or trigger my 2fa? I wish I was able to contact google. EDIT: my only guess was accessing my PC where logins are saved, but I sleep in the same room and I don't think ninja spies broke in. Remote login? Seems farfetched.