[Security Discussion] s1lentechoes:
Hey all and thanks in advance for any help you can provide as I have been racking my brain trying to figure this one out, but keep falling flat. A few days ago I received a Google Assistant notification on my Nexus 5X running the current stock Android (no rooting or modification on this device in any way). It was bringing to my attention an "important" email about one of my credit cards. I was immediately suspicious as this was the first time I had ever gotten a notification of this kind from Google Assistant. Usually it is sports score updates, bill reminders, breaking news, etc... But it did appear to be a legitimate Google Assistant notification so I did click it (I later confirmed this as I checked my notification history and it did show up as a Google App notification). It then opened Google Assistant, but then immediately opened either Chrome itself or a Chrome custom tab. The address that it opened appeared to be the legitimate Gmail domain, and unless it was using non Latin characters then I have no reason to believe otherwise. Not only that but it was showing an already opened email claiming to be from one of my credit card companies stating that there were important changes to their policies and/or my account.

It was at this point that I knew something was amiss. Images were being blocked in the email and just the whole process seemed "off". I opened Inbox/Gmail on my desktop and sure enough there was no such email there, it was at this point that I knew beyond doubt it was a scam. I was very careful not to click anything in the email but I could see that the "To:" label was to my legitimate email address and the "From:" address was typical of a phishing/scam email (eg. the name of the credit card company but with some kind of modifier attached). I wish I would have taken a screenshot of it, but it all caught me off guard. If it happens again believe me I will.

What made this all even weirder was when I tried to access this link on my desktop as I wanted to try and run some tests on the link that it was trying to get me to click on. I went on my Chrome history to track the link down but it was not there. So I checked my Chrome history on my phone and sure enough it showed up there, but not on my desktop. It was the only link not showing up on my desktop's Chrome history, all other links were there and I could see the same two links that were before and after the link in my phone's Chrome history but not that one. I have since factory reset my phone to be on the safe side and sure enough on my new install that link is also not showing up there either.

Now I am fairly well versed in tech, am very disciplined in "think before you click", and pride myself in being able to spot a scam - but I am also no expert and this is where I am needing some help in figuring out what exactly happened. I need to figure out if my device was compromised or if there is any way a malicious actor could have triggered my Google Assistant to open up a link like it did.

There is more to this story though which makes it a bit more complicated. Towards the beginning of the year I had a credit card that got compromised, this credit card was from the same company that the scam email was claiming to be from. Luckily I have alerts turned on and I was able to spot it almost immediately and reported it. The card was cancelled and I received a new one. I had my suspicions about how it was compromised but nothing for sure (I have never had a security problem like this, and I had recently used a website that I had never used before to purchase something - not damning itself but definitely suspicious). A couple months later and it happened again. At this point I was about 95% sure which website had compromised it. I believe the website itself was not malicious but that it's database had been breached, meaning the card only became compromised if it was "stored" in my account as a payment option. Also of note was that I have two cards with this particular company and only the one card I used on this website was compromised, not both cards nor the account itself (no other cards, companies, or payment options either). Further confirmation of my suspicions are that since I narrowed which website I thought that it was and it has not happened again.

My whole reason brining all of that up is that without it, to me anyways it would seem like my device is compromised. But with that story, and the fact that scam email was obviously phishing for my login credentials to that company makes it seem like someone somehow figured out a way to trigger my Google Assistant. Not only that, but triggered it to open up someone else's Gmail in a Chrome tab with an email already opened. Is that even possible? Do third party apps or services have this kind of access to Google Assistant? If not, it would seem to indicate for certain that my device is/was compromised, yeah?

As I already stated, I have since factory reset my phone, and every website and service I use has strong passwords and 2FA with alerts turned on if possible. But without knowing exactly how this attack was possible I still feel vulnerable. I have seen many phishing attacks in my day but this one seemed personalized, not mass targeted like the other which also makes me worry (again, even more so since I am not certain how this one happened). Plus I am worried that if it was my device that was compromised then a factory reset may not be enough. Many, many thanks for anyone who has a more intimate knowledge of Google's developer ecosystem that can help.

[EDIT} I will continue to add some things here that I think may be relevant to diagnosing this issue.

I was not doing anything at the time that this notification was sent. I was not even on my phone - I use Pushbullet to get notifications on my desktop and it was there that I first noticed it. And honestly, I do not even use my phone that much as I am near my desktop almost all the time. The rare times that I do use it, it is for listening to music or podcasts, almost no web browsing at all and very little app usage.

I was at home at the time of the notification, meaning no public or untrusted Wi-Fi. Nor at risk of any bluetooth type attack either.

I do use a VPN at all times.