Remus stealer ads claim Gmail access survives password changes
Original title: Remus malware claims Gmail access even after you change your password
Hudson Rock found no controlled test or Gmail zero-day behind the seller's persistence claims.
Remus Stealer version 1.3.9 promotional material advertises opening a compromised Gmail mailbox from an operator dashboard, including after password changes and session revocation. Hudson Rock reviewed the pitch and questioned the developer and a self-described customer. It concluded the material does not prove access after a comprehensively secured account, or a Gmail vulnerability. Google says password changes ordinarily invalidate application tokens, but that does not confirm the seller's claim.
Unconfirmed: Persistence claims come from the seller and an unverified customer; Hudson Rock did not reverse-engineer or validate them.
- The seller claims verification codes can be intercepted without browser cookie files.
- A customer said access continued after browser closure, a session reset, and a password change.
- That source's independence, account settings, and timing were not established.
- Screenshots do not show an MFA bypass, mail sending, or control of every linked account.
Impact: Claimed Gmail reading after password and session changes
- 1.Secure the Google account from a separate trusted device.
- 2.Disconnect the suspected device and remove the malware before signing in again.
- 3.Change the Google password, review sessions, and check forwarding and app access.
- ATT&CK
- T1114 Email Collection
- Vendors
- Malware
- Remus Stealer
- Organizations
- Hudson Rock
From the original article
3 min read at malwarebytes.comDevelopers of the infostealer Remus claim their malware can retain access to a victim’s Gmail even after a password reset.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.