Cybercriminals have discovered a technique to obtain access to people’s Google accounts without requiring a password, and the new exploit allows hackers to continue using Google services even after a user’s password has been changed.
The new vulnerability was discovered and reported on by the security firm CloudSEK. Furthermore, the flaw first came to light in October 2023 when a hacker tweeted about it on a Telegram channel.
According to the Independent report, Google accounts could be stolen due to a flaw in third-party cookies used by websites and browsers to track users and improve their effectiveness.
Furthermore, Google’s authentication cookies allow users to retain their login information and log in without re-entering it. However, hackers have discovered a technique to circumvent two-factor authentication and obtain these cookies.
“This exploit enables continuous access to Google services, even after a user’s password is reset,” CloudSEK wrote in a blog post. It emphasizes the importance of ongoing monitoring of technological vulnerabilities and human intelligence sources to remain ahead of developing cyber threats.”
Meanwhile, The Independent report says Google Chrome is improving its defenses and protecting users from viruses. A Google statement states, “We routinely upgrade our defenses against such techniques and to secure users who fall victim to malware.” “In this case, Google has taken action to secure any compromised accounts discovered,” the company stated.
“Users should continually take steps to remove any malware from their computer, and we recommend turning on Enhanced Safe Browsing in Chrome to protect against phishing and malware downloads.” Furthermore, the company added.
