Remus Stealer is being marketed with a claim that, if true, could let attackers retain access to a compromised Gmail account even after its password is changed, the browser is closed and active sessions are signed out. The alleged capability has not been independently confirmed.
According to a Hudson Rock investigation, the feature is advertised in Remus Stealer version 1.3.9. Remus is an infostealer, a type of malware designed to collect information from infected computers. Its developers say the new feature can let operators view Gmail messages from the malware’s administration panel, intercept verification codes and potentially provide other criminals with access to compromised inboxes.
The developers claim the tool temporarily uses data held in browser memory rather than collecting cookie files. The precise technique is unknown, although authorization tokens are one possible explanation. There is no demonstrated evidence that the malware exploits a Gmail zero-day vulnerability.
The capability is sold as part of Remus Stealer’s subscription tiers, with the claimed pricing set in U.S. dollars per month:
- Basic: $250 per month
- Pro: $500 per month
- Enterprise: $1,000 per month, including the claimed Gmail-persistence feature
Hudson Rock said it spoke with the malware developer and an alleged customer, but did not conduct controlled tests showing that account access survives all account-security steps. That leaves open whether Remus has an advanced persistence mechanism or whether its operators are overstating the product’s capabilities to potential buyers.
Anyone who suspects an infection should remove the malware, change passwords from a known-safe device, and review active sessions, connected applications and account-recovery settings. The key unanswered question is whether Remus can actually maintain Gmail access after those remediation measures are completed.
