Hello, thank you very much for your very insightful comment!

The cookie theft is also IMHO the most probable scenario. The malicious extension is the only thing that make sense to me.

log out all devices: done

rotate password and 2FA: done

switch to a hardware key/WebAuthn: not done yet

audit browser extensions: done (I'm using only what I think are very "secure" ones: Bypass Paywalls Clean, Control Panel for Twitter , Correcteur d'orthographe et reformulateur — LanguageTool , Google Images Restored, I still don't care about cookies, Keepa - Amazon Price Tracker, Reddit Enhancement Suite, SingleFile , uBlock Origin , Voir image (https://github.com/bijij/ViewImage)

scan the box: done

revoke any third‑party app access tied to Reddit: there are none

Anyhow, thank again!