Having expired or invalidated session cookies regenerated using another piece of stolen identity data.
In November 2023, Lumma and Rhadamanthys announced that they could revive stolen, expired Google authentication cookies. According to CloudSEK’s analysis, the method used an undocumented endpoint called “MultiLogin”, which is meant to synchronise Google accounts across services. BleepingComputer
The malware takes a token and account ID pair from the Chrome profile; when that pair is sent to MultiLogin, new valid Google cookies are generated. Access can therefore persist for a while even if the user signs out or changes their password. BleepingComputer
The infostealer reads the token and account ID pair from the browser profile. BleepingComputer
The pair is sent to the account synchronisation endpoint and new session cookies are obtained. BleepingComputer
The new cookies are loaded into the attacker’s browser. MITRE ATT&CK
According to BleepingComputer, Lumma started using the method on 14 November 2023 and encrypted the token and account ID pair to hide it from competitors; at least six infostealers announced the same capability. BleepingComputer
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy