COMPROMISING GOOGLE ACCOUNTS: MALWARES EXPLOITING UNDOCUMENTED OAUTH2 FUNCTIONALITY FOR SESSION HIJACKING

Summary from the TLDR InfoSec newsletter

A critical Google exploit was discovered in October 2023 that enabled persistent access after password resets. A threat actor reverse-engineered this into Lumma Infostealer, protecting it with blackboxing. The exploit spread rapidly among malware groups. CloudSEK identified its root as an undocumented Google Oauth endpoint "MultiLogin". This report examines the exploit's discovery, evolution, and cybersecurity implications.