New malware attack is so nasty it can hijack your Google account using expired cookies — how to stay safe

A picture of a skull made from computer code depicting a malware infection.

Several info-stealing malware strains are actively exploiting an undocumented Google OAuth endpoint named MultiLogin to take over Google accounts even after a password reset.

As reported by BleepingComputer, this exploit allows certain malware strains to restore expired authentication cookies which are then used to login to victims’ Google accounts.