Skip to content
NewA calmer, faster ZeroHour
StoryMalwaremedium

Remus Stealer pitches unverified Gmail access after password changes

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Hudson Rock has not verified Remus Stealer's claim that a paid feature keeps reading Gmail after password resets.

Remus Stealer version 1.3.9 is advertising an Enterprise tier at $1,000 a month that its developer says can keep reading a Gmail inbox after password changes and session revocation. Hudson Rock reviewed the pitch, questioned the developer and a self-described customer, and says screenshots show sharing of an already compromised mailbox but do not prove persistence after a comprehensively secured account or a Gmail vulnerability. The firm has not run a controlled test. Google says password changes ordinarily invalidate application tokens, which does not confirm the seller's claim. Hudson Rock says the computer must first be infected and advises cleaning it before changing passwords on a clean device.

Key facts
  • Basic, Pro and Enterprise tiers are listed at $250, $500 and $1,000.
  • The pitch is version 1.3.9 and claims no browser-cookie collection.
  • The seller claims verification codes can be intercepted without browser cookie files.
  • The developer calls it a Gmail zero-day; Hudson Rock has not reproduced that.
  • Screenshots do not show an MFA bypass, mail sending, or control of every linked account.
  • Hudson Rock advises cleaning the infected computer before changing passwords on a clean device.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • Security AffairsPricing tiers, infection prerequisite, and cleanup advice before password changes.
  • Malwarebytes LabsGoogle token statement, unestablished customer details, and limits of the screenshots.
Vendors
Google
Products
GmailRemus
Malware
Remus Stealer
Organizations
Hudson Rock

Coverage

oldest first · one row per article · UTC
  1. · 10h ago Security AffairsFirst report

    Remus Stealer advertises $1,000 Gmail access that survives resets

    Hudson Rock has not verified persistence after password changes or a Gmail vulnerability.

  2. · 7h ago Malwarebytes Labs

    Remus stealer ads claim Gmail access survives password changes

    Hudson Rock found no controlled test or Gmail zero-day behind the seller's persistence claims.