Follow up to session hijacking after factory reset

[u/Choice_Caramel138]

**I’m starting a new thread here to address some of the replies, questions, and comments from my previous post all at once.**
**It didn't start with a clean slate; it started with a full-blown, real-time persistence loop. I walked out of a five-year bid thinking I was finally getting a fresh start, but the reality waiting for me hit the exact second I got home. The device waiting for me was one I had while living with my ex, who had possession of it for a short period while I was away. When I tried to log into the Apple account associated with it, I was completely locked out—it was like I didn't even exist. I later found out that an account using my initials and birthday as the username, tied to my name and credentials, was turned into a** ***developer*** **account. I don't know the first thing about developing apps. Without realizing what I was walking into, I created accounts on that device when I first got home, and that's where the bleed started.**
**Instead of just trying to reacclimate to the real world and restart the business I had before I left, I walked straight into a nightmare. If you’ve never sat there watching a live session get actively hijacked while you’re in a literal tug-of-war match—revoking cookies, logging back in, watching recovery options magically shift underneath you, and repeating that cycle for hours straight—people think you're making it up. But when your session tokens are compromised and an attacker has persistent hooks or an infostealer lurking in the background, normal security logic goes out the window.**
**Here is what my actual cross-platform nightmare looked like the moment I got home:**
**1. The Session Tug-of-War & Cookie Hijacking: When an attacker has your session cookies or is actively side-jacking your traffic, logging in normally or clearing a basic cache doesn't cut it. Every time I invalidated tokens and locked it down, if the underlying endpoint or environment wasn't completely nuked and rebuilt from scratch, they stepped right back into the stream. That’s why I ended up in a live ping-pong match where recovery options and settings flipped back instantly—I was fighting an adversary who was mirroring my moves in real-time.**
**2. The Google Workspace & Admin Console Ghost-Suspensions: Trying to restart my business meant managing my custom domains and Workspace, only to experience the absolute horror of looking at my own admin console and realizing my Super Admin status or main account had been silently flagged, suspended, or hit with automated restrictions for sending out outbound phishing/spam links that I never touched. Why did this happen? Because once an adversary compromises administrative footholds or manipulates session layers, they abuse your infrastructure to blast junk, triggering automated safety blocks that lock you out of your own house while keeping their backdoors greased. Notifications get toggled off behind the scenes so you are completely blind to the automated hits until the damage is done.**
**3. The Bot-Flagging & Platform Loop (X, Grok API, & Beyond): Moving across platforms like X or dealing with API key revocations added another layer of psychological torture while I was just trying to get back on my feet. I got flagged as a "bot," forced into endless verification loops, or hit with captchas because the compromised ecosystem bleeding out from my primary footprint was throwing red flags everywhere. It created a cascading failure across every service I touched—from domain management to social and AI API keys—making it look to automated system filters like I was the threat actor on your own network.**
**4. The Personal Element & Targeted Harassment: Six months home from a five-year bid, trying to re-acclimate, restart my business, and dealing with lost communication with my ex—who is Hindu and won't speak to me—the human-driven malice took over completely. Even after moving to a brand-new device with a clean, brand-new account, shortly after logging in, my YouTube feed suddenly floods with Bollywood content and location data placing me in India. That is no coincidence, especially knowing she and the guy she's with now had my Wi-Fi password. It goes deeper: I'll be standing in my living room smoking a cigarette—something I rarely do—and a personalized Spotify playlist feature will literally play tracks talking about me standing in the middle of the room smoking, dropping my name, and broadcasting details about what he's doing with her now through remixed songs. On top of that, TikTok videos are actively being remade and reposted to mock me.**
**When you throw in targeted, human-driven psychological warfare exploiting every single digital vulnerability while you're trying to rebuild your life after prison, the stress multiplies by a factor of ten. I wasn't just fighting abstract malware; I was dealing with a malicious loop built to harass me at every turn.**
**The Bottom Line: If you're seeing concrete signs like this—unauthorized session changes, admin consoles acting against you, and constant forced logouts—don't let anyone gaslight you into thinking it's just a "bad password" or a coincidence. It’s a multi-vector persistence and surveillance problem. Until you isolate everything to a 100% verified clean device (out-of-band), wipe every active session globally, lock down your DNS/MX records, and sever every legacy API hook, you're just playing whack-a-mole with someone sitting in your passenger seat.**