Not foolproof, but I wonder why sessions aren’t linked to an IP to prevent this.
Hello, thank you very much for your very insightful comment!
The cookie theft is also IMHO the most probable scenario. The malicious extension is the only thing that make sense to me.
log out all devices: done
rotate password and 2FA: done
switch to a hardware key/WebAuthn: not done yet
audit browser extensions: done (I'm using only what I think are very "secure" ones: Bypass Paywalls Clean, Control Panel for Twitter , Correcteur d'orthographe et reformulateur — LanguageTool , Google Images Restored, I still don't care about cookies, Keepa - Amazon Price Tracker, Reddit Enhancement Suite, SingleFile , uBlock Origin , Voir image (https://github.com/bijij/ViewImage)
scan the box: done
revoke any third‑party app access tied to Reddit: there are none
Anyhow, thank again!
Even if none of these extensions were malicious, they might have some vulnerability that would allow and attacker to get your cookie? Or the developers of those might have unknowingly been phished like what happened last December.
Sorry for just offering speculation, hopefully you figure it out. Even if it was "only" a Reddit account, the feeling of not knowing how it happened and if other things are at risk must be horrible.
https://crxplorer.com/ might help you to inspect your extensions a bit deeper if you are interested and have the knowledge.
And finally, just a comment, passkeys/webauthn/fido keys would not protect against a session cookie theft. They only prevent the login stage from being phished.
I've just had my Amazon account hacked with an order of a gift card. I saw it immediately so I was able to request a refund, change passwords, add 2fa, remove any payment info.
This is probably linked, I still don't understand how this is possible...
Thanks again for your input! I'll look into crxplorer.