Temporary Advertisements:
Ad
Ad
Ad
[POC] Google OAuth "MultiLogin" endpoint 0-day
by Farfallaiero - Friday December 29, 2023 at 05:40 PM
#1
Informational POC


Multiple information-stealing malware families are abusing an undocumented Google OAuth endpoint named "MultiLogin" to restore expired authentication cookies and log into users' accounts, even if an account's password was reset.
Rhadamanthys, Risepro, Meduza and Stealc Stealer adopted this technique. On December 26, White Snake also implemented the exploit.

Hidden Content
You must register or login to view this content.
0D|nS3c
Reply
#2
Amazing discovery, thanks for sharing this!
Reply
#3
(Dec 29, 2023, 05:40 PM)Farfalla Wrote: Informational POC


Multiple information-stealing malware families are abusing an undocumented Google OAuth endpoint named "MultiLogin" to restore expired authentication cookies and log into users' accounts, even if an account's password was reset.
Rhadamanthys, Risepro, Meduza and Stealc Stealer adopted this technique. On December 26, White Snake also implemented the exploit.

really nice..
Reply
#4
(Dec 29, 2023, 05:40 PM)Farfalla Wrote: Informational POC


Multiple information-stealing malware families are abusing an undocumented Google OAuth endpoint named "MultiLogin" to restore expired authentication cookies and log into users' accounts, even if an account's password was reset.
Rhadamanthys, Risepro, Meduza and Stealc Stealer adopted this technique. On December 26, White Snake also implemented the exploit.

Why do we need to pay credits if it's available for free ?
Reply
#5
Im gonna test this rn. I have read about this and needed to see how it works.
Reply
#6
lests test and see this
Reply
#7
thanks for the share my guy Big Grin
Reply
#8
Holy shit thanks man
Reply
#9
Thank's for the exploit
Reply
#10
Thanks for sharing
Reply


Possibly Related Threads…
Thread Author Replies Views Last Post
  {SECRET} DATABASE OF EXPLOITS lulagain 468 36,593 7 hours ago
Last Post: msgtuna
  Google Dorks for finding SQL injection vulnerabilities and other security issues 1yush 81 7,291 Yesterday, 06:52 PM
Last Post: npmig
  new wordpress website takeover vuln (video + poc ) zinzeur 321 33,424 Yesterday, 06:51 PM
Last Post: npmig
  0day-RCE-Apache OFBiz avix 0 888 Sep 11, 2026, 04:02 AM
Last Post: avix
  New Zer0 Day Wordpress A3g00n 89 7,203 Aug 31, 2026, 09:05 PM
Last Post: carcino25

Forum Jump:


 Users browsing this forum: