Attackers Abuse Google OAuth Endpoint to Hijack User Sessions

Infostealers such as Lumma and Rhadamanthys have integrated the generation of persistent Google cookies through token manipulation.

https://www.darkreading.com/cloud-security/attackers-abuse-google-oauth-endpoint-hijack-user-sessions