I suspected a bios rootkit I couldn't find definitive evidence at the time.
Why do you suspect a BIOS rootkit?
I am not surprised you can find no evidence. (1) BIOS rootkits are extremely sophisticated and therefore, tend to be in the arsenals of those listed by Solaris17, and by those with equally deep pockets conducting cyberwarfare against those enemies. In other words, they are designed to leave no evidence. It also means (2) while they do exist, it is very rare, in fact difficult to become infected by one. And, even more rare for the same person to have their phone and their Windows based computers to become infected. The hardware and the OS are just too different.
Aren’t UEFI files nowadays digitally signed and unless said private keys get leaked (and I don’t remember that happening to Gigabyte for their X570 boards), then infecting and rewriting firmware code is impossible?
I would not say "impossible" - but extremely difficult. This is why Microsoft pushed to make UEFI a requirement - despite the fact they knew the MS haters would bash them for it - as they have, relentlessly. But that's a different discussion.
In fact, it actually is pretty hard for even Windows 10/11 to become infected at all these days.
"IF" the user (ALWAYS the weakest link in security) simply keeps Windows and their security software current, and they avoid being "click-happy" on unsolicited links, downloads, attachments, and popups, the odds of being compromised are very slim.
Now if the user invites the bad guy in by failing to keep their OS and security current, by participating in illegal activities or visiting illegal porn and gambling sites, and by carelessly clicking on every link they see, then compromise is possible, maybe even inevitable. But cross-platform infection? I doubt that.
I don't think it fair to accuse anyone, at this point, of trolling. There's enough misinformation, FUD, etc. out there, some sophisticated enough to trick even the most seasoned professional.
Just today I got an extremely realistic notice from Chase Manhattan Bank informing me of a problem with my account, and to "click here" to contact a representative to get it resolved. It had perfect spelling and perfect grammar - formally where signs of scams were easily detected. It had 2 problems, however. My name is not "Customer" and "Chase Manhattan Bank" does not exist. It changed it's name to just "Chase Bank" several years ago. Still, my point is, it was so well done otherwise, it could have tricked the naïve.
What is needed is better education to make the naïve aware of these threats, how to recognize them, and how to mitigate/negate them by keeping their systems current, and avoid being "click-happy" - regardless how legitimate that "unsolicited" email, text, phone call or whatever may appear.
For that reason, unless it degrades into a cesspool of $h!t and nonsense, I think this thread should remain open - for now.
So make sure any backup file or image you have is clean before using it.
