[throw10920]

You're right - thee fact that Google and Apple passwords were both compromised (given how insanely good their internal security is) strongly suggests either malware or password manager compromise.

[loa_in_]

Given that it's likely from an infostealer malware it might be from user internet browser profile password databases.