update in case anyone stumbles across this later: the software that caused the issue has been identified and was related to one of my clients product code, no b

update in case anyone stumbles across this later: the software that caused the issue has been identified and was related to one of my clients product code, no browser extension, mentioned mac utility application or phishing attack was the cause. my takeaways: - non sms 2FA is obligatory everywhere no exception - password expiration after one year makes sense and can help finding breaches much faster - applications should have an enforceable field to attach a note to a new session for finding possible breach source or remembering legitimate access that is further in the past - passwords are stupid and should be replaced in general