The developers of Remus Stealer malware are offering cybercriminals access to other people’s Gmail inboxes, which they claim remains active even after users change their passwords and terminate active sessions. They charge $1,000 per month for this capability, although Google denies the existence of any vulnerability in its service.
Cybersecurity researchers at Hudson Rock have discovered a new feature in Remus Stealer, an infostealer designed to steal sensitive data from infected computers. Its developers claim that operators can now read victims’ emails directly through the malware’s control panel, even if the account owner has changed their password or revoked active sessions.
The feature appeared in promotional materials for Remus Stealer version 1.3.9 and is available through the Enterprise subscription, which costs $1,000 per month. According to the developers, the malware does not even need to steal browser cookies to intercept emails and verification codes.
Screenshots published by Hudson Rock show a fully functional email interface with a message list, sender addresses, timestamps, and a search function. Operators can select a record associated with an infected computer, open the linked mailbox, read emails, and even grant other users access to the inbox through a special link.
This means that email itself is not the only potential target. If attackers can read incoming messages, they may intercept password reset links, one-time verification codes, and other information needed to access third-party services, including cryptocurrency platforms and work accounts.
Hudson Rock co-founder Alon Gal reported that researchers spoke directly with the Remus Stealer developer and an individual who had publicly vouched for the new tool’s functionality. According to the developer, the malware interacts with browser memory, performs the necessary operations, and then terminates.
One user of the service told researchers that access to the mailbox persists even after the browser is closed, the session is reset, and the Google account password is changed. The developer describes this capability as a zero-day vulnerability, although there is currently no independent technical confirmation of such a mechanism.
The Remus Stealer developer also claims that customers have already tested the feature’s effectiveness and that the malware can bypass Google’s anti-fraud mechanisms. However, the developer has not disclosed the technical details needed for independent experts to verify these claims.
Hudson Rock researchers speculate that Remus may obtain or create reusable authentication credentials while a user is logged into Gmail through an infected browser. A remote component could then potentially access the mailbox without requiring the malware to run again on the victim’s computer.
However, this mechanism alone does not explain why access would persist after all compromised permissions had been fully revoked. Researchers have not identified the specific token, browser interaction method, or other technical mechanism used by the new feature. There is also no confirmed test demonstrating that attackers can continue receiving new emails after an account has been fully secured.
In response to journalists’ inquiries, a Google spokesperson stated that infostealer attacks designed to steal session tokens from users’ devices have long been known to cybersecurity experts.
“There is no Gmail or Google vulnerability at play here.”
Google emphasized that the company continuously improves its built-in protections against session hijacking and automatically takes measures to secure accounts when suspicious activity is detected. Users can invalidate stolen sessions by removing malware from infected devices and revoking active sessions.
The company also explained why simply changing a password does not always solve the problem. If an infostealer remains on a computer, it can capture a new authentication session even after the account owner changes their password. Therefore, the infection must first be removed before the email account can be properly secured.
At the same time, Google has not confirmed the existence of a new Gmail vulnerability, and Hudson Rock researchers have been unable to independently demonstrate that Remus Stealer can maintain access to incoming emails after all relevant permissions have been fully revoked.
Security experts recommend taking additional precautions beyond simply changing a password if a computer is suspected of being infected with an infostealer. The first step is to isolate the device, scan it for malicious software, and completely remove the infection before using it again to access important accounts.
Compromised passwords should be changed from another trusted device. Users should then review their connected devices through Google Account Devices, terminate unfamiliar sessions, and revoke suspicious third-party application access. Google’s Security Checkup tool can also help users review their account security settings.
Special attention should be paid to Gmail settings. Attackers may create automatic email forwarding rules, modify filters, configure delegated access, or connect third-party email clients. Even after changing a password, these settings should be checked manually. Users should also review account recovery methods, recent security activity, and the security of other services linked to the same email address.
Google additionally recommends enabling Enhanced Safe Browsing in Chrome for stronger protection against malicious websites and downloads, as well as using passkeys for more secure authentication.
Despite the developers’ bold claims, there is currently no evidence that Remus Stealer exploits an unknown Google vulnerability. Hudson Rock confirmed that the advertised email access feature exists and obtained testimony from one of its users, but no independent testing has demonstrated that access persists after an account has been fully secured.
The main concern is that Remus Stealer offers cybercriminals a convenient way to access compromised email inboxes and potentially use them to take over additional accounts. That is why recovering from an infostealer infection requires checking not only the password but also the device, active sessions, application permissions, and email settings.
