Google: Malware abusing API is standard token theft, not an API issue

Multiple information-stealing malware families are abusing an undocumented Google Chrome OAuth 'MultiLogin' endpoint to use stolen tokens (including a refresh-like token) to generate new authentication cookies after the originals expire, enabling prolonged unauthorized access to victims' Google accounts; Google views this as cookie-theft rather than a vulnerability and recommends logging out or revoking sessions to mitigate.