Google OAuth endpoint exploited by various malware

BleepingComputer reports that expired authentication cookies are being revived for account access by numerous information-stealing malware strains by leveraging the newly discovered MultiLogin Google OAuth endpoint. MultiLogin, which was developed to facilitate the synchronization of accounts across various Google services, was exploited by infostealers to enable the collection of token and Chrome account IDs with GAIA ID and encrypted_token, according to a CloudSEK report.

Source: SC Magazine

 

Date:

Categorie(s):

Tag(s):

, , ,