[POC] Google OAuth "MultiLogin" endpoint 0-day
by Farfallaiero - Friday December 29, 2023 at 05:40 PM
#1
Informational POC


Multiple information-stealing malware families are abusing an undocumented Google OAuth endpoint named "MultiLogin" to restore expired authentication cookies and log into users' accounts, even if an account's password was reset.
Rhadamanthys, Risepro, Meduza and Stealc Stealer adopted this technique. On December 26, White Snake also implemented the exploit.

Hidden Content
You must register or login to view this content.
0D|nS3c
Reply
#2
Amazing discovery, thanks for sharing this!
Reply
#3
(Dec 29, 2023, 05:40 PM)Farfalla Wrote: Informational POC


Multiple information-stealing malware families are abusing an undocumented Google OAuth endpoint named "MultiLogin" to restore expired authentication cookies and log into users' accounts, even if an account's password was reset.
Rhadamanthys, Risepro, Meduza and Stealc Stealer adopted this technique. On December 26, White Snake also implemented the exploit.

really nice..
Reply
#4
(Dec 29, 2023, 05:40 PM)Farfalla Wrote: Informational POC


Multiple information-stealing malware families are abusing an undocumented Google OAuth endpoint named "MultiLogin" to restore expired authentication cookies and log into users' accounts, even if an account's password was reset.
Rhadamanthys, Risepro, Meduza and Stealc Stealer adopted this technique. On December 26, White Snake also implemented the exploit.

Why do we need to pay credits if it's available for free ?
Reply
#5
Im gonna test this rn. I have read about this and needed to see how it works.
Reply
#6
lests test and see this
Reply
#7
thanks for the share my guy Big Grin
Reply
#8
Holy shit thanks man
Reply
#9
Thank's for the exploit
Reply
#10
Thanks for sharing
Reply


Possibly Related Threads…
Thread Author Replies Views Last Post
  {SECRET} DATABASE OF EXPLOITS lulagain 440 27,444 Yesterday, 09:44 PM
Last Post: caribou
  Dokan Pro Unauthenticated SQL Injection POC | CVSS 10 Loki 44 3,958 Yesterday, 04:45 PM
Last Post: Insulina
  Ban Any Discord Exploit phineasfisherman 7 522 May 06, 2026, 10:16 AM
Last Post: sniperx86
  New Zer0 Day Wordpress A3g00n 81 3,527 May 05, 2026, 03:06 AM
Last Post: DirtyEra
  Wordpress Elementor 3.11.6 Exploit - Full Takeover TheGoodlife 102 19,830 May 04, 2026, 06:45 AM
Last Post: eztocard

Forum Jump:


 Users browsing this forum: 1 Guest(s)