Could a Briefly Appearing App and an Unexpected 2FA Code Mean My Ubuntu System Was Hacked?

The two events may be unrelated. An unexpected 2FA code usually means someone knows your username or email and is attempting to sign in; it does not prove that your computer was hacked. Change the affected account’s password, use a unique password, revoke other active sessions, check recovery settings, and make sure your email account is secure. Do this from another trusted device if possible.

Before wiping the system, try to identify what is launching. You can watch system logs with `journalctl -f`, and tools such as `execsnoop-bpfcc` can record newly executed processes. Check whether the behavior continues with a fresh Chrome profile or in Firefox, since a browser extension or profile issue could be responsible. Avoid running commands copied from untrusted sources with administrator privileges.

If you knowingly installed suspicious software, ran an untrusted script with `sudo`, or find clear signs of persistence, disconnect the machine from the network, back up only personal documents, and reinstall Ubuntu from official installation media. A clean reinstall is reasonable when you cannot establish confidence in the system, but formatting immediately is not necessary just because an app flashes briefly or an account sends a 2FA prompt.

You can also review recently installed packages, browser extensions, startup applications, cron entries, and user-level systemd services. Keep Ubuntu and the browser fully updated, remove extensions you do not recognize, and use repository packages where possible. Antivirus tools are not a definitive way to prove a Linux system is clean, so investigate the process and account activity rather than relying on a single scanner.