{"id":54968,"date":"2024-01-03T01:02:19","date_gmt":"2024-01-03T01:02:19","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/google-password-resets-not-enough-to-stop-these-info-stealing-malware-strains\/"},"modified":"2024-01-03T01:02:19","modified_gmt":"2024-01-03T01:02:19","slug":"google-password-resets-not-enough-to-stop-these-info-stealing-malware-strains","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/google-password-resets-not-enough-to-stop-these-info-stealing-malware-strains\/","title":{"rendered":"Google password resets not enough to stop these info-stealing malware strains"},"content":{"rendered":"

Security researchers say info-stealing malware can still access victims’ compromised Google accounts even after passwords have been changed.<\/p>\n

A zero-day exploit of Google account security was first teased by a cybercriminal known as “PRISMA” in October 2023, boasting that the technique could be used to log back into a victim’s account even after the password is changed. It can also be used to generate new session tokens to regain access to victims’ emails, cloud storage, and more as necessary.<\/p>\n

Since then, developers of info-stealer malware \u2013 primarily targeting Windows, it seems \u2013 have steadily implemented the exploit in their code. The total number of known malware families that abuse the vulnerability stands at six, including Lumma and Rhadamanthys, while Eternity Stealer is also working on an update to release in the near future. They’re called info stealers because once they’re running on some poor sap’s computer, they go to work finding sensitive information \u2013 such as remote desktop credentials, website cookies, and cryptowallets – on the local host and leaking them to remote servers run by miscreants.<\/p>\n