Ask HN: Actions to take after session hijack?

As of this week, it seems my browser session has been hijacked. Both my Instagram and LinkedIn have been used for Crypto scams. All my accounts have 2FA, so I know it's not just password stealing. These are the actions ive taken so far:

- Logged out of all devices on said websites + GitHub. - Changed my Google password, and logged out of all my devices but my phone (I'm fairly confident my phone is not confiscated. I can't say the same about my Windows PC).

I want to figure out what has been sniffing my sessions, because I am not confident that wiping my Windows PC will make sure these sessions won't get sniffed again. I'm not strong enough of a CyberSecurity person to figure out where this tool could be.