Temporary Advertisements:
Ad
Ad
Ad
[POC] Google OAuth "MultiLogin" endpoint 0-day
by Farfallaiero - Friday December 29, 2023 at 05:40 PM
#1
Informational POC


Multiple information-stealing malware families are abusing an undocumented Google OAuth endpoint named "MultiLogin" to restore expired authentication cookies and log into users' accounts, even if an account's password was reset.
Rhadamanthys, Risepro, Meduza and Stealc Stealer adopted this technique. On December 26, White Snake also implemented the exploit.

Hidden Content
You must register or login to view this content.
0D|nS3c
Reply
#2
Amazing discovery, thanks for sharing this!
Reply
#3
(Dec 29, 2023, 05:40 PM)Farfalla Wrote: Informational POC


Multiple information-stealing malware families are abusing an undocumented Google OAuth endpoint named "MultiLogin" to restore expired authentication cookies and log into users' accounts, even if an account's password was reset.
Rhadamanthys, Risepro, Meduza and Stealc Stealer adopted this technique. On December 26, White Snake also implemented the exploit.

really nice..
Reply
#4
(Dec 29, 2023, 05:40 PM)Farfalla Wrote: Informational POC


Multiple information-stealing malware families are abusing an undocumented Google OAuth endpoint named "MultiLogin" to restore expired authentication cookies and log into users' accounts, even if an account's password was reset.
Rhadamanthys, Risepro, Meduza and Stealc Stealer adopted this technique. On December 26, White Snake also implemented the exploit.

Why do we need to pay credits if it's available for free ?
Reply
#5
Im gonna test this rn. I have read about this and needed to see how it works.
Reply
#6
lests test and see this
Reply
#7
thanks for the share my guy Big Grin
Reply
#8
Holy shit thanks man
Reply
#9
Thank's for the exploit
Reply
#10
Thanks for sharing
Reply


Possibly Related Threads…
Thread Author Replies Views Last Post
  Wordpress Elementor 3.11.6 Exploit - Full Takeover TheGoodlife 111 25,303 Today, 12:20 AM
Last Post: nullun1331
  new wordpress website takeover vuln (video + poc ) zinzeur 330 39,469 Today, 12:13 AM
Last Post: nullun1331
  {SECRET} DATABASE OF EXPLOITS lulagain 479 42,636 Today, 12:04 AM
Last Post: nullun1331
  CVE-2026-109618/9 nullun1331 0 104 Yesterday, 11:59 PM
Last Post: nullun1331
  [CVE-2024-37383] Roundcube Mail Server Vulnerability PoC global2141 19 2,622 Oct 21, 2026, 03:04 AM
Last Post: losing

Forum Jump:


 Users browsing this forum: 1 Guest(s)