Remus Stealer advertises Gmail access that survives password changes

The operators of Remus Stealer are advertising a new feature that lets criminals read victims’ Gmail inboxes directly from the malware’s control panel, including messages containing verification codes and account recovery links.

The developer claims this access survives password changes and session revocation. However, an investigation by Hudson Rock has yet to confirm that claim or establish that the feature exploits a Gmail vulnerability.

The cybersecurity firm examined the announcement for Remus version 1.3.9 and contacted both the developer and a customer who had publicly endorsed the feature.

Remus is an information stealer, a type of malware that collects passwords and other sensitive data from infected computers. Its operators sell access to the service, with the new mailbox feature reserved for an Enterprise tier advertised at $1,000 per month.

For criminals using Remus, the appeal is convenience. A ‘Mail’ option beside each stolen-device record opens a mailbox viewer, bringing email access into the same dashboard used to browse stolen credentials.

Screenshots included in Hudson Rock’s report show an interface resembling webmail, with senders, subject lines, message previews, and a search box. One displays a Pinterest verification email, while another includes messages from several services.

The developer also advertises shareable mailbox links, allowing criminals to give others access to an inbox they have already compromised.

Although Remus’s sales pitch emphasizes cryptocurrency services and YouTube accounts, the potential exposure extends further. An inbox can contain private correspondence, financial information, and password-reset messages for both personal and workplace accounts. Reading those messages could help attackers break into additional services, depending on their security controls.

Continued access unproven

The developer told Hudson Rock that the feature interacts with browser memory and that the malware runs before exiting. A customer separately said email remained accessible after closing the browser, resetting sessions, and changing the Google password.

Those accounts suggest Remus may obtain reusable access while the victim’s browser is signed in, allowing criminals to retrieve mail after the stealer stops running. Hudson Rock has not identified exactly how this works.

The bigger question is whether that access really survives the victim securing the account. Hudson Rock did not conduct a controlled test showing a newly delivered email appearing in Remus after a password change and the removal of existing sessions and application access. The customer’s account does not document those recovery steps in enough detail to settle the issue.

Anyone affected by an infostealer infection should secure their accounts from a clean device while isolating and cleaning the infected computer. Change compromised passwords, sign out of unfamiliar devices, and remove suspicious applications connected to the account.

Google’s recovery guidance also recommends checking Gmail forwarding rules, filters, delegation, and recovery details for unauthorized changes.