Attackers Abuse Google OAuth Endpoint to Hijack User Sessions

CloudSEK researchers uncovered that a threat actor named 'Prisma' disclosed an exploit abusing an undocumented Google OAuth "MultiLogin" endpoint, allowing generation of persistent authentication cookies and session hijacking that remain effective after password resets; multiple infostealer families (Lumma, Rhadamanthys, Risepro, Meduza, Stealc Stealer, White Snake) have adopted and enhanced the technique, using encrypted payloads and SOCKS proxies to evade detection and IP restrictions.