Google Responds to Detection of Session Token Malware Capable of Hijacking Accounts: Report

The zero-day exploit allows malicious users to regenerate an authentication cookie to log in to a user's account, even after a password change.

Written by David Delima, Edited by Siddharth Suvarna | Updated: 3 January 2024 15:17 IST

Highlights

Hackers can use stolen session tokens to gain access to a user's account
The exploit allows hackers to gain long-term access to Google accounts
Users can revoke the sessions by logging out of the affected browser

Google Responds to Detection of Session Token Malware Capable of Hijacking Accounts: Report

Users can enable Enhanced Safe Browsing on Chrome to avoid malware downloads

Photo Credit: Unsplash/ @firmbee

Malware designed to steal information from users and hijack their Google accounts is being exploited by multiple malicious groups — even after a password has been reset — according to security researchers. The exploit is reportedly aimed at Windows computers. Once the device is infected, it uses a technique used by "info stealers" to exfiltrate the login session token — assigned to a user's computer when they log in to their account — and upload it to the cybercriminal's server.

According to a report published by researchers at CloudSEK, the malware was first launched by threat group PRISMA in October 2023, and uses the search giant's OAuth endpoint called MultiLogin that is used by Google to allow users to switch between user profiles on the same browser or use multiple login sessions simultaneously. The malware uses auth-login tokens from a user's Google accounts that are logged in on the computer. The necessary details are decrypted with the help of a key that is stolen from the UserData folder in Windows, as per the report.

Using the stolen login session tokens, malicious users can even regenerate an authentication cookie to log in to a user's account after it has expired — it can even be reset once, when a user changes their password. As a result, the malware operators can retain access to a user's account. Threat intelligence group Hudson Rock has provided a demonstration of the flaw being exploited.

Here's Why You Need to Uninstall These 'SpyLoan' Apps From Your Phone

Meanwhile, BleepingComputer points out that various malware creators have already started to use the exploit to gain access to user data — on November 14, the Lumma stealer was updated to take advantage of the flaw, followed by Rhadamanthys (November 17), Stealc (December 1), Medusa (December 11), RisePro (December 12), and Whitesnake (December 26).

In a statement to 9to5Google, the search giant said that it routinely upgraded its defences against the techniques used by malware, and that compromised accounts detected by the company have been secured.

How Fake Chrome, Safari Updates Can Infect Your Mac With AMOS Malware

Google also points out that users can revoke or invalidate the stolen session tokens by either logging out of the browser on a device that has been infected with the malware, or by accessing their devices page in their account settings and remotely sign out of those sessions. Users can also scan their computers for malware and enable the Enhanced Safe Browsing setting in Google Chrome to avoid downloading malware to their computers, according to the company.

Is the Samsung Galaxy Z Flip 5 the best foldable phone you can buy in India right now? We discuss the company's new clamshell-style foldable handset on the latest episode of Orbital, the Gadgets 360 podcast. Orbital is available on Spotify, Gaana, JioSaavn, Google Podcasts, Apple Podcasts, Amazon Music and wherever you get your podcasts.

Affiliate links may be automatically generated - see our ethics statement for details.

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.