Malware abuses Google OAuth endpoint to ‘revive’ cookies, hijack accounts

**Executive summary:** Multiple information-stealer malware families are abusing an undocumented Google OAuth "MultiLogin" endpoint to restore expired Google session cookies and maintain persistent access to compromised accounts; CloudSEK and researchers reverse-engineered the technique and show several stealers (Lumma, Rhadamanthys, Stealc, Medusa, RisePro, Whitesnake) have adopted the exploit while Google states it has taken actions to secure compromised accounts and advises removing malware and revoking sessions.