A way to access Google accounts without a password by Hackers

A recent discovery by security researchers has unveiled a new hacking technique that enables cyber criminals to infiltrate individuals’ Google accounts without requiring their passwords. CloudSEK, a security firm, conducted an analysis and identified a malicious form of malware that exploits third-party cookies to gain unauthorized access to users’ private data. This dangerous exploit is already being actively tested by various hacking groups.

The revelation of this exploit occurred in October 2023 when a hacker shared information about it on a Telegram channel. The hacker explained how accounts could be compromised through a vulnerability associated with cookies. Cookies are utilized by websites and browsers to track users and enhance their browsing experience.

Google authentication cookies play a crucial role in allowing users to access their accounts without repeatedly entering their login credentials. However, the hackers have discovered a method to retrieve these cookies, thereby bypassing the security measures of two-factor authentication.

To address this issue, Google Chrome, the world’s most widely used web browser with a market share exceeding 60% last year, is currently taking steps to crack down on third-party cookies.

“We routinely upgrade our defences against such techniques and to secure users who fall victim to malware. In this instance, Google has taken action to secure any compromised accounts detected,” Google said in a statement.

“Users should continually take steps to remove any malware from their computer, and we recommend turning on Enhanced Safe Browsing in Chrome to protect against phishing and malware downloads.”

The researchers who first uncovered the threat said it “underscores the complexity and stealth” of modern cyber-attacks.

“This exploit enables continuous access to Google services, even after a user’s password is reset,” Pavan Karthick M, a threat intelligence researcher at CloudSEK, wrote in a blog post detailing the issue.

“It highlights the necessity for continuous monitoring of both technical vulnerabilities and human intelligence sources to stay ahead of emerging cyber threats.”

The report, titled ‘Exploiting Undocumented OAuth2 Functionality for session hijacking: Malwares Compromising Google Accounts’, was authored by Pavan Karthick M., a threat intelligence researcher at CloudSEK.