Beware of this sneaky Google attack that steals your expired cookies

A new exploit threat lets hackers access your Google account using expired cookies that contain your login information. The exploits, which were discovered late last year, target session cookies, which only have a limited lifespan. However, they can “revive” those cookies, putting your personal information at risk.

A hacker named PRISMA first revealed they found a way to bring back expired Google session cookies. Since then, cybersecurity firm CloudSEK discovered an exploit in a program that allows users to synchronize their Google accounts across multiple devices. Now, hackers are using that exploit to steal your login and other information. Here’s a breakdown of how it all unfolded and how you can protect yourself.

CLICK TO GET KURT’S FREE CYBERGUY NEWSLETTER WITH SECURITY ALERTS, QUICK VIDEO TIPS, TECH REVIEWS AND EASY HOW-TO’S TO MAKE YOU SMARTER

Google Chrome start-up page (Kurt “CyberGuy” Knutsson)

Exploiting Google’s MultiLogin

As reported by BleepingComputer, certain malware strains have discovered a backdoor into Google’s authentication system. The vulnerability lies in the MultiLogin endpoint, which remains undocumented and largely unknown to the public. This clandestine gateway enables threat actors to revive expired authentication cookies, granting unauthorized access to users’ Google accounts.

Google Chrome start-up page (Kurt “CyberGuy” Knutsson)

MORE: BEWARE OF THIS MCAFEE GOOGLE CHROME AD SCAM

The role of session cookies

Before we dive deeper, let’s understand the role of session cookies. These specialized browser cookies contain authentication information. If you’ve ever experienced the convenience of returning to a site without re-entering your credentials, you’ve encountered session cookies. However, their design intentionally limits their lifespan to prevent prolonged unauthorized access.

MORE: HOW GOOGLE’S DATA CAN MAKE YOU A SUSPECT IN A CRIME YOU DIDN’T COMMIT

The Lumma and Rhadamanthys connection

In November of last year, cybercriminals associated with the Lumma and Rhadamanthys info-stealing malware strains made a bold claim: they could resurrect expired Google Authentication cookies stolen during cyberattacks. Armed with these seemingly defunct cookies, a hacker gains entry to a victim’s Google account, even if the user has logged out, reset their password, or their session has expired.

PRISMA’s revelation

The exploit’s origins trace back to a Telegram post by a threat actor known as PRISMA. In October, they unveiled their discovery: a method to restore Google authentication cookies that had reached their expiration date. This revelation set the stage for further investigation.

CloudSEK’s investigation

Enter CloudSEK, a cybersecurity firm committed to predicting and preventing cyberattacks. Their researchers took on the challenge, reverse engineering the exploit. Their findings revealed that the MultiLogin endpoint served as the linchpin for the hackers. This undocumented feature facilitates account synchronization across various Google services, making it an ideal target for malicious actors’ nefarious activities.

Google Chrome start-up page (Kurt “CyberGuy” Knutsson)

MORE: GOOGLE FINALLY ADMITS DATA COLLECTION IN CHROME’S INCOGNITO MODE

Protecting against MultiLogin exploit

The exploitation of MultiLogin raises serious concerns for those of you who are Google account holders. To safeguard against this threat, consider the following steps:

1) Sign out of the affected browser: Google is aware of this issue and has taken action to secure compromised accounts. Google’s recommendation is to simply sign out of the affected browser to revoke session cookies.

2) Enhanced Safe Browsing: Enable Enhanced Safe Browsing in Chrome for additional protection against malware and phishing attacks.

On your computer:

• Open Google Chrome on your computer
• Click the initial in the top-right corner of the browser window
• Tap Manage your Google Account 
• Click Security on the left
• Under Enhanced Safe Browsing for your account – make sure it is turned On

On your smartphone:

• Open Google Chrome on your computer
• Click the initial in the top-right corner of the browser window
• Tap Google Account 
• Click Security 
• Scroll down and under Enhanced Safe Browsing for your account – make sure it is turned On

3) Regularly change passwords: Regularly change your Google password to keep your account safe from hackers. If you struggle with creating new passwords, consider using a password manager.

4) Have good antivirus software on all your devices: The best way to protect yourself from having your data breached is to have antivirus protection installed on all your devices. Choose the best option for your PC, Mac, iPhone or Android smartphone. Having good antivirus software actively running on your devices will alert you of any malware in your system, warn you against clicking on any malicious links in phishing emails and ultimately protect you from being hacked. Get my picks for the best 2024 antivirus protection winners for your Windows, Mac, Android & iOS devices.

Kurt’s key takeaways

In light of the recent exploits targeting Google accounts through resurrected session cookies, it’s imperative to strengthen our defenses against such cyberthreats. From the initial discovery by PRISMA to the subsequent investigations by CloudSEK, the vulnerabilities in Google’s MultiLogin endpoint have now been exposed.

To protect your account, ensure you sign out of affected browsers, enable Enhanced Safe Browsing, regularly update passwords, and have good antivirus software across all your devices. By implementing these security measures, you can thwart attempts to compromise your online privacy and safeguard your digital identities.

How important do you think it is for technology companies like Google to continually update and enhance their security protocols to protect you from evolving cyberthreats? Let us know by writing us at Cyberguy.com/Contact.

For more of my tech tips & security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.

Ask Kurt a question or let us know what stories you’d like us to cover.

Answers to the most asked CyberGuy questions:

Copyright 2024 CyberGuy.com. All rights reserved.