Researchers: hackers are abusing Google OAuth endpoint “MultiLogin” to restore expired authentication cookies and log into accounts even after a password reset
Multiple information-stealing malware families are abusing an undocumented Google OAuth endpoint named “MultiLogin” …
Context & Ripple Effects
This report shifts attention from stolen passwords to the persistence of authenticated browser sessions: the claimed abuse would let infostealer operators retain account access after a user takes the conventional recovery step of changing a password.
It sits within a broader OAuth abuse record, including malicious OAuth apps tied to fraudulent Microsoft partner accounts. Follow-up coverage said Google viewed this class of token theft as not a new attack technique, underscoring that session and token controls matter alongside password hygiene.
First-order effects
- Users whose authentication cookies were stolen could remain exposed after a password reset, because the reported technique restores access through an OAuth-related session mechanism rather than the password itself.
- Google OAuth becomes the immediate focus for validation and mitigation, while affected account holders and administrators need incident response that addresses active sessions and tokens, not only credentials.
Second-order effects
- Organizations that treat password resets as the endpoint of account recovery may need to revise playbooks toward session invalidation, token review, and detection of anomalous reauthentication activity.
- Infostealer malware gains more value when it can capture reusable session material, increasing the security priority of browser-session protection and endpoint cleanup.
Third-order effects
- If session-token theft continues to outlast password resets, identity security will increasingly be judged on whether providers can bind, revoke, and monitor sessions—not solely on password and MFA controls.
- OAuth ecosystems may face sustained pressure to make opaque authentication flows more auditable, as abuse can arise both from malicious app authorization and from compromised user sessions.
The trend: The story is one data point in identity attacks moving from password theft toward reusable session and OAuth-token theft that can survive traditional recovery steps.