Follow us on Google News
Developers of a malware strain called Remus Stealer are advertising a feature that allegedly allows cybercriminals to access victims’ Gmail inboxes even after passwords are changed and active sessions are revoked. The service is reportedly being offered for $1,000 per month, raising concerns about the security of email accounts compromised through information-stealing malware.
Cybersecurity firm Hudson Rock investigated the claims after identifying advertisements for the feature, which reportedly allows malware operators to search stolen Gmail inboxes and view messages through a dedicated dashboard.
Google has rejected suggestions that the activity involves a previously unknown vulnerability in Gmail, stating that the reported technique concerns malware targeting account sessions on infected devices.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
How Does Remus Stealer Allegedly Maintain Access to Gmail?
According to Hudson Rock, the developers of Remus Stealer claim their malware can provide continued access to compromised Gmail accounts without relying on traditional browser cookie theft.
The advertised feature reportedly allows operators to open a victim’s mailbox through a dashboard associated with a compromised device.
Screenshots examined by researchers showed an interface displaying email messages, sender details, timestamps and search functions. The platform also appeared to offer an option to share mailbox access with other operators.
Hudson Rock co-founder Alon Gal said researchers contacted the malware developer and a person publicly endorsing the service.
The developer claimed that the malware interacts with browser memory before executing its operations and exiting the infected system.
A person claiming to have used the service further alleged that mailbox access continued after the browser was closed and even after the victim changed their Google password.
The developer described the technique as a Gmail zero-day vulnerability.
However, researchers have not independently established that the claimed access would survive properly completed account recovery procedures, including the effective revocation of compromised authorisation.
Hudson Rock suggested that the malware might obtain reusable authorisation while the victim is signed in to Gmail through an infected browser.
Such access could potentially allow a remote component to retrieve messages after the initial malware process has stopped, provided the authorisation remains valid.
Google Denies Zero-Day Vulnerability, Points to Malware-Based Session Theft
Responding to the report, Google said there was no evidence of a vulnerability in Gmail or Google’s systems.
A company spokesperson explained that information-stealing malware targeting browser sessions on personal devices is an established threat.
Google said it regularly strengthens its protections against session theft and automatically secures accounts when suspicious activity is detected.
The company maintained that users can invalidate compromised sessions by removing malware from affected devices and revoking active sessions.
Google also warned that changing a password while malware remains present on a device may allow attackers to capture newly created sessions.
The company advised users to remove the infection before resetting credentials and reviewing account access.
The reported Remus Stealer feature has not been independently confirmed to bypass Google’s security controls after complete remediation.
Consequently, the claims do not establish that attackers can permanently retain Gmail access or that a new Gmail vulnerability has been discovered.
Why Could Persistent Email Access Threaten Other Online Accounts?
If the advertised Remus Stealer capabilities operate as claimed, attackers could potentially access password reset emails, verification messages and other sensitive communications.
This could increase the risk of additional account compromises, particularly where Gmail is used to recover passwords or verify access to financial, business and social media services.
Hudson Rock researchers said victims of information-stealing malware should examine whether attackers have established alternative methods of accessing their accounts.
Such methods may include unauthorised email forwarding rules, altered account recovery settings, delegated mailbox access or connections to third-party applications.
Users are advised to isolate infected devices, remove malicious software and change compromised passwords from a separate, trusted device.
They should also review signed-in devices, revoke suspicious sessions, check account recovery information and examine Gmail settings for unauthorised changes.
Google recommends using its Security Checkup tools, enabling Enhanced Safe Browsing in Chrome and adopting passkeys to strengthen account protection.
The findings highlight the risks associated with information-stealing malware and the potential consequences of compromised email access, while the claimed ability to retain Gmail access after complete account recovery remains unverified.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
