“BleepingComputer has contacted Google multiple times over a month with questions about these claims and how they plan to mitigate the issue, but we never received a response.”
Lumma and Rhadamanthys steal a token and account ID from Chrome and feed them to an undocumented Google endpoint called MultiLogin to mint fresh session cookies. Logging out does not stop it. Resetting your password only cuts it to one more regeneration. A threat actor announced the trick on Telegram on October 20, and Google has spent two months saying nothing.