I am an h1b from India, working for one of those Indian contracting companies as a contractor to an US company. For my work, I use my employer provided laptop to remote login to client's Azure AVD remote desktop.
____
The incident:
One day, I was talking to a colleague about the 100 year wait period for greencards through client's MS teams. I shared him some twitter links (where people say they would be 115 when they get greencard and such) through Whatsapp. While I was talking about it, Teams got disconnected. Didn't think anything about it, thought it was just a network issue.
Same day, I was talking to another colleague, mentioned the same greencard thing, and shared the twitter links over Whatsapp. Again, MS teams got disconnected. I thought it was an odd coincidence that it got disconnected twice when I talked about this subject.
Same day, at around 9.30 pm, I get an email from Twitter saying they blocked a suspicious login from a city in US. So, someone knew my user name & password.
____
Regarding how someone would know my Twitter username & password: While applying for US visa, we need to give our social media user names in the DS160 form, which my employer will also see. I have used this password else where, so some data breach may have leaked it.
I don't know if one of the employees whom I talked to snitched me to my employer or my client was monitoring my Teams conversation (or Teams is looking for trigger words) and decided to investigate further where I am getting these info from Twitter.
____
This was the Twitter alert I got:
Suspicious login alert
There was an attempt to log in to your account @accountname that seems suspicious.
Suspicious login
Device: Unknown
Location: Springfield, MA, USA
When: date & time (11 minutes ago)
*Location is approximate based on the login's IP address.
If this was you
- There is no need to take any action right now. Just to be safe, you'll need to answer some security questions the next time you login to this account.
If this wasn't you
- Change your password now to protect your account. You'll be logged out of all your active Twitter sessions except the one you're using this time.