Compromising Google Accounts: Malwares Exploiting Undocumented OAuth2 Functionality for session hijacking

A client, a threat actor, later reverse-engineered this script and incorporated it into Lumma Infostealer, protecting the methodology with advanced blackboxing techniques.

CloudSEK's threat research team, leveraging HUMINT and technical analysis, identified the exploit's root at an undocumented Google Oauth endpoint named 'MultiLogin'.

Read at Databreaches