Malware Leveraging Google Cookie Exploit via OAuth2 Functionality

CloudSEK researchers disclosed that several malware operators are exploiting an undocumented Google OAuth2 "MultiLogin" endpoint to regenerate authentication cookies and maintain persistent access to Google accounts even after password resets; multiple infostealer families (including Lumma) have integrated this capability, using token/GAIA-ID manipulation, encryption, and proxies to evade detection and sustain session hijacking.