Accessing an online account typically requires a username and password, but cybersecurity researchers at CloudSEK have uncovered a disturbing trend where hackers can gain unauthorized entry into Google accounts without the need for a password. This illicit method exploits malware, and although it was initially disclosed in October 2023 on a Telegram Channel, it has gained traction among hackers following promotion on Reddit.
The vulnerability centers around the exploitation of third-party cookies, which have become a preferred tool for hackers. Cookies, designed to enable websites and browsers to monitor user activity, can be intrusive, recording online shopping, viewing habits, and downloads. Some even transmit this information to marketing firms, leading to targeted advertising. Authentication cookies, which store critical information like passwords, are particularly attractive to hackers as they allow unauthorized access without the need for re-entry of credentials.
This exploitation poses a significant cybersecurity threat, especially in bypassing Two-Factor Authentication (2FA) to retrieve cookie data. Google, recognizing the severity of the situation, is actively working to secure compromised accounts affected by this malware. The tech giant is dedicated to ensuring the highest level of security for its 1 billion active users globally.
For users of Firefox, there is relatively little cause for concern, as it is recognized for providing one of the safest browsing experiences, at least up to a certain point in time. However, Chrome users can enhance their browsing security by activating the ‘Enhanced Safe Browsing’ mode within their settings. As for Edge users, Microsoft claims a different story, suggesting a distinct approach to security.
