Malware Leveraging Google OAuth for Persistent Account Access

Amber | Vulnerability Report

Download PDF Download PDF

Information-stealing malware is actively exploiting an undisclosed Google OAuth endpoint called MultiLogin. This technique was initially disclosed by a threat actor named PRISMA on their Telegram channel and has subsequently been integrated into various malware-as-a-service (MaaS) stealer families.

Hive Pro

Reduce real exposure. Not just vulnerability volume.

© 2026 HivePro. All rights reserved.Privacy Policy Terms & Conditions

Built by