You know the drill. A strange login alert pops up, your stomach drops and you frantically change your password. Then you exhale, close the tab and get on with your day. Crisis handled, right? It might not be as simple anymore, as a piece of malware called Remus Stealer is being advertised on cybercrime forums with the pitch that criminals can read a victim’s Gmail inbox from a control panel. The access supposedly survives a password change and closing the browser.
Cybersecurity researchers haven’t independently verified that the malware can maintain access after someone fully secures their account and revokes active sessions. Still, the feature is disturbing enough to warrant attention, especially because email is often the master key to everything else online. So, you want to read this to the end.
Remus Stealer turns Gmail into a hacker dashboard
Remus Stealer is an infostealer, a type of malware designed to harvest sensitive information from infected computers, including passwords and login credentials. Its operators are now advertising a feature that brings Gmail inboxes directly into the malware’s control panel. According to cybersecurity firm Hudson Rock, the feature appears in Remus version 1.3.9 and is being sold through an Enterprise subscription reportedly costing $1,000 per month.
Instead of simply collecting stolen credentials, subscribers can reportedly open a mailbox viewer and browse messages from a compromised Gmail account.
Screenshots examined by Hudson Rock show an interface resembling ordinary webmail, complete with senders, subject lines, message previews and a search box. One screenshot displays a Pinterest verification email. Others show messages from different services, illustrating how much information an exposed inbox could contain. The operators also advertise shareable mailbox links, potentially allowing hackers to pass access to compromised inboxes around without sharing the original stolen credentials.
Surviving a password reset
The malware’s developers claim that changing a Google password or revoking sessions won’t necessarily stop their mailbox access. A person who publicly endorsed Remus reportedly told Hudson Rock that access persisted after closing the browser and changing the password. But that is not the same as proving Gmail accounts remain accessible after they are properly secured.
Hudson Rock examined the malware’s promotional announcement, contacted its developer and spoke with a customer. The researchers have not demonstrated in a controlled test that Remus can continue retrieving newly delivered messages after a victim changes their password, revokes existing sessions and removes unauthorized application access.
The developer reportedly described the feature as interacting with browser memory before the malware exits. That suggests the software may obtain access while a victim is signed in, but the precise mechanism remains unclear. So, while the claims are alarming, this isn’t confirmation that Google has a newly discovered Gmail vulnerability or that every password reset is useless.
Your cleanup checklist
If your computer has been infected with an infostealer, changing passwords from that same compromised device is not the safest recovery strategy. Start by securing your accounts from a clean device and isolating the infected computer. Then change compromised passwords, especially to your Google account and other important services.
You also want to sign out devices and sessions you don’t recognize and check third-party applications connected to your Google account. Inspecting your Gmail settings is also a very important step here. Look for unauthorized forwarding addresses, filters, recovery details or mailbox delegation.
Google recommends removing malware from affected devices and revoking active sessions to invalidate stolen session access.
These steps are crucial because an attacker who has modified Gmail settings or connected an unauthorized application could leave behind another route into your account.
The old password reset isn’t everything
The sales pitch may be marketing hype. At the same time, account security does not begin and end with a password. A strong password can still be compromised if malware steals credentials or access tokens from your computer. And an inbox that someone else can read could expose the recovery links needed to compromise even more accounts.
Infostealers don’t need every advertised feature to cause serious damage. Regardless of whether or not the pitch is true, you are better off taking every step you can to keep your accounts safe.
Sources: New York Post, Cyber Insider