As a hacker is targeting me, I set up two throwaway accounts (Facebook, Gmail) without two-factor authentication as a trap, and, indeed, the attacker deleted an email in Gmail and marked unread notifications as read in Facebook right before my eyes.
Unfortunately, though, the login protocols show nothing whatsoever; they got in and out without being noticed by the system. So my question is: how advanced do they have to be to achieve that?
Unfortunately, though, the login protocols show nothing whatsoever; they got in and out without being noticed by the system. So my question is: how advanced do they have to be to achieve that?

