Compromising Google Accounts: Malwares Exploiting Undocumented OAuth2 Functionality for session hijacking

CloudSEK researchers detail an active exploit of an undocumented Google OAuth 'MultiLogin' endpoint that allows attackers to regenerate persistent Google service cookies from exfiltrated token:GAIA ID pairs, enabling account persistence even after password resets; the technique was rapidly adopted and blackboxed by multiple infostealer families (Lumma, Rhadamanthys, Stealc, Meduza, RisePro, WhiteSnake) between October–December 2023, with technical analysis showing token theft from Chrome's token_service and Local State decryption and HUMINT corroboration of the exploit's origin and spread.