Multiple information-stealing malware families are exploiting an undocumented Google OAuth endpoint called “MultiLogin” to restore expired authentication cookies and gain unauthorized access to users’ accounts.