(Daily Point) — Several cybersecurity reports from BleepingComputer, CloudSEK, and Hudson Rock have highlighted a significant vulnerability affecting users of Google Chrome.
This vulnerability allows unauthorized access to Google accounts and login tokens, enabling the extraction and decryption of tokens from the local database. The malware involved can bypass Chrome’s security measures, posing a threat to user accounts, even those protected by two-factor authentication. Notably, the exploit continues to grant access even after users change their passwords.
Despite the severity of the situation, Google is seeking to downplay the significance of the vulnerability. In a statement provided to BleepingComputer, the tech giant asserted that malware attacks aimed at stealing cookies and tokens are not new. Google assured users that it routinely enhances its defenses against such techniques and takes action to secure compromised accounts. The company suggested logging out of the Chrome browser and terminating all active sessions via g.co/mydevices to invalidate the Refresh token.
Contrary to external assessments, Google does not view this as a vulnerability, asserting that the API functions as intended. The company recommends user actions to mitigate risks but maintains that the situation is not as critical as some reports suggest.
In a related development, cybersecurity firm CloudSEK revealed that multiple information-stealing malware operations are exploiting a Google OAuth “MultiLogin” API endpoint. This feature allows the generation of new authentication cookies when a victim’s original stolen Google cookies expire. Notably, this method involves stealing multiple tokens from Google Chrome, including authentication cookies for Google sites and a special token for refreshing or generating new authentication tokens.
This new malware trend, exemplified by operations such as Lumma, Rhadamanthys, Stealc, Medusa, RisePro, and Whitesnake, highlights an ongoing challenge for cybersecurity professionals. The attackers leverage the API to continuously refresh authentication tokens, making it imperative for users to be vigilant and take recommended security measures.
