Hackers Find Way to Breach Google Accounts without Password

Security experts discover a method to infiltrate Google accounts without password requirement, posing a severe threat to users’ privacy and digital security.

CloudSEK, a leading security firm, has identified a sophisticated malware that leverages third-party cookies to gain unauthorized access to sensitive data on Google services.

This alarming exploit was brought to public attention in October 2023 by a hacker in a Telegram channel, unveiling its potential to compromise accounts through cookie vulnerabilities.

The malware adeptly retrieves Google authentication cookies, allowing hackers to bypass two-factor authentication and maintain persistent access to users’ accounts even after password resets.

With Google Chrome, the world’s predominant web browser, already undertaking measures to curb third-party cookies, there is an urgent need for users to fortify their defenses against such cyber threats.

In response to this discovery, Google has taken swift action to secure compromised accounts and advised users to remove any malware from their devices while activating Enhanced Safe Browsing in Chrome for additional protection against phishing and malware downloads.

Pavan Karthick M, a respected threat intelligence researcher at CloudSEK, emphasized the complexities of modern cyber attacks in their findings, stressing the critical importance of continual monitoring of technical vulnerabilities and human intelligence sources to proactively thwart emerging threats.

Furthermore, CloudSEK has published a detailed report titled ‘Compromising Google accounts: Malwares Exploiting Undocumented OAuth2 Functionality for session hijacking’, shedding light on the severity and implications of this significant security flaw.

This report underscores the pressing need for heightened vigilance and strategic defenses against evolving cyber threats in today’s digital landscape.