Google has warned that nearly 2.5 billion Gmail accounts may be exposed in a massive data theft campaign, urging users to reset passwords, review app permissions, and enable two-factor authentication.

Google is downplaying reports of malware abusing an undocumented Google Chrome API to generate new authentication cookies when previously stolen ones have expired.

Google says it recently fixed an authentication weakness that allowed crooks to circumvent email verification needed to create a Google Workspace account, and leverage that to impersonate a domain ...