[POC] Google OAuth "MultiLogin" endpoint 0-day
by Farfallaiero - Friday December 29, 2023 at 05:40 PM
#1
Informational POC


Multiple information-stealing malware families are abusing an undocumented Google OAuth endpoint named "MultiLogin" to restore expired authentication cookies and log into users' accounts, even if an account's password was reset.
Rhadamanthys, Risepro, Meduza and Stealc Stealer adopted this technique. On December 26, White Snake also implemented the exploit.

Hidden Content
You must register or login to view this content.
0D|nS3c
Reply
#2
Amazing discovery, thanks for sharing this!
Reply
#3
(Dec 29, 2023, 05:40 PM)Farfalla Wrote: Informational POC


Multiple information-stealing malware families are abusing an undocumented Google OAuth endpoint named "MultiLogin" to restore expired authentication cookies and log into users' accounts, even if an account's password was reset.
Rhadamanthys, Risepro, Meduza and Stealc Stealer adopted this technique. On December 26, White Snake also implemented the exploit.

really nice..
Reply
#4
(Dec 29, 2023, 05:40 PM)Farfalla Wrote: Informational POC


Multiple information-stealing malware families are abusing an undocumented Google OAuth endpoint named "MultiLogin" to restore expired authentication cookies and log into users' accounts, even if an account's password was reset.
Rhadamanthys, Risepro, Meduza and Stealc Stealer adopted this technique. On December 26, White Snake also implemented the exploit.

Why do we need to pay credits if it's available for free ?
Reply
#5
Im gonna test this rn. I have read about this and needed to see how it works.
Reply
#6
lests test and see this
Reply
#7
thanks for the share my guy Big Grin
Reply
#8
Holy shit thanks man
Reply
#9
Thank's for the exploit
Reply
#10
Thanks for sharing
Reply


Possibly Related Threads…
Thread Author Replies Views Last Post
  {SECRET} DATABASE OF EXPLOITS lulagain 435 26,319 10 hours ago
Last Post: DirtyEra
  New Zer0 Day Wordpress A3g00n 81 3,316 Today, 03:06 AM
Last Post: DirtyEra
  Wordpress Elementor 3.11.6 Exploit - Full Takeover TheGoodlife 102 19,680 Yesterday, 06:45 AM
Last Post: eztocard
  new wordpress website takeover vuln (video + poc ) zinzeur 314 28,309 Apr 30, 2026, 03:54 PM
Last Post: baku
  Google Dorks for finding SQL injection vulnerabilities and other security issues 1yush 66 3,159 Apr 29, 2026, 08:51 PM
Last Post: Yjuddur

Forum Jump:


 Users browsing this forum: 1 Guest(s)