I received Google's "Suspicious sign in prevented" email, and verified that it is legitimate, and this is definitely not my login attempt. I immediately changed my Google password, however, the email is very light on details, and it is not clear whether my password was in fact compromised, or someone just tried to login with a wrong password (e.g. nothing to worry about).
My Google password is not guessable, not used anywhere else, not written anywhere, not known to anyone else, so if someone knows it this means I've got a keygen or some other malware on one of my computers.
So, does anybody know what Google's
tried to use an application to sign in to your Google Account actually means? What kind of a credential (password, OAuth token, etc.) was compromised, if any?