How do attackers gain access to a VKontakte page?

Question

In contact with

The situation is this. My girlfriend's VKontakte page was hacked. Without thinking about the method of hacking, I changed her password, tied it to my mail, broke sessions and deleted all applications that had access to the page via API. Respectively covered all the holes. The next day, the VK page again subscribed to groups with dildos and bdsm. Tell me where to dig?
UPD: the girl is sitting in VK from her phone and tablet. Rarely from a computer, it has Linux on it. If it comes from someone, then presses the exit button. She doesn’t use Wi-Fi in cafes after I showed her traffic sniffing.

Answer 1

Perhaps this is not a hack, but a hint.

Answer 2

Switch her account to forced https and repeat the same thing that you have already done.

Answer 3

Well, firstly, the API cannot be accessed to get the user's email, so this is superfluous.
2) always check the hosts, it may have a rule in which vk.com will be redirected to a completely different server, where the VK page is copied, when it enters, they receive data.
3) I hope you do not manually delete all groups, write to those support in VK, they will clean everything up
4) in the same support you will be advised to check, with this program https://vk.com/app2951231_19459572

Answer 4

The reason is that Windows is installed, put Linux.

Answer 5

Most likely an already authorized site-application. Once received authorization through OAuth will not be deleted just like that. I looked for a page that displays authorized application sites with their permissions, but did not find it.

Answer 6

try clicking here