Malware Using Google MultiLogin Exploit to Maintain Access Despite Password Reset

Information-stealing malware families (including Lumma, Rhadamanthys, Stealc, Meduza, RisePro, and WhiteSnake) are abusing an undocumented Google OAuth MultiLogin endpoint to convert GAIA ID + encrypted token pairs extracted from Chrome's WebData token_service into valid Google session cookies, enabling persistent account access even after password resets. The report outlines three token-cookie scenarios, notes that Google can revoke compromised sessions (users can sign out or remove devices), and recommends enabling Enhanced Safe Browsing, changing passwords, and monitoring device activity to mitigate abuse.