0-day exploit for one-click Google account takeover for sale

For informational purposes only.

Vulnerability Type: Account Takeover Price: • Current Offer (CO) — approximately $60,000 • Buy It Now (BIN) — $150,000

The seller claims to be selling a 0-day vulnerability that allows remote takeover of Google accounts via session hijacking.

According to the seller, for the attack to succeed, all that is required is for the victim—while logged into Gmail—to click on a specially crafted link. Once the link is clicked, the attacker can allegedly obtain the active session ID and use it to access the account without knowing the password. The seller claims that the exploit works on the principle of 1-click Account Takeover (ATO) and requires no further action from the victim after opening the link.

As proof, a screenshot of a terminal showing the files of the alleged exploit chain has been published, including components for path traversal and session hijacking.