# Remus Stealer Malware Targets Gmail Inboxes via Persistent Unauthorized Access New malware allegedly maintains Gmail access even after password changes and session revocations. - **Source:** [Science & tech Articles | Mail Online](https://www.dailymail.com?ns_mchannel=rss&ns_campaign=1490&ito=1490) - **Published:** 2026-11-10 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/d4285401-b5da-4657-b2df-aad9620e6568 ## Emerging Gmail Security Threat A new malicious software tool dubbed Remus Stealer is currently being marketed on underground hacking forums. The malware is advertised as a subscription service costing $1,000 per month. It reportedly grants cybercriminals the ability to search through victim Gmail inboxes, read private messages, and intercept sensitive security verification codes. ## Persistent Access Claims The developers claim the tool maintains access to compromised Gmail accounts even after victims change their passwords or close their browsers. Hudson Rock researchers investigated these assertions by speaking with the developer and a user. They viewed screenshots displaying email content, timestamps, and search functions within a dedicated hacker dashboard. ## Technical Mechanism Uncertainties The malware developer suggests the software interacts with browser memory before exiting the system. Hudson Rock analysts hypothesize the tool may acquire reusable authorization tokens while the browser is signed in. However, researchers have not independently verified how the malware bypasses standard security measures like session revocation or password resets. ## Google Official Stance Google has disputed claims that the malware exploits a previously unknown vulnerability within Gmail. A company spokesperson stated that attacks involving infostealer malware targeting session tokens on personal devices are not new. Google maintains that it routinely updates its defenses and that no specific Google or Gmail flaw is involved. ## Broader Impact Risks If the malware functions as advertised, it poses significant risks beyond email exposure. Criminals could intercept password reset links and verification codes to hijack bank accounts, social media profiles, or other online services. The tool also features a sharing function, allowing multiple hackers to access a single compromised mailbox simultaneously. ## Targeting and Distribution The software is marketed toward enterprise customers, suggesting it may be intended for high-level individuals or organizations. While researchers have not established the exact infection vector, infostealers typically spread through malicious downloads disguised as legitimate programs. Users are advised to remain vigilant against phishing attempts that create a sense of urgency. ## Recommended Security Protocols Hudson Rock advises victims to isolate infected computers and perform a thorough cleanup before accessing sensitive accounts. Passwords should be changed exclusively from a separate, secure device. Additionally, users should review signed-in devices, revoke suspicious sessions, and check Gmail settings for any unauthorized changes or third-party application access permissions. ## Future Defensive Outlook While the full efficacy of Remus Stealer remains unverified by independent security experts, the threat highlights the dangers of session token theft. If the tool proves effective, Google will likely introduce additional protections to safeguard both business and individual users. Maintaining updated antivirus software remains a critical layer of defense. ## Sources covering this story - [Tom's Guide — New Remus Stealer Malware Grants Persistent Gmail Access for Monthly Fee](https://www.tomsguide.com/computing/malware-adware/dangerous-new-gmail-exploit-lets-hackers-read-your-emails-for-a-monthly-fee-of-usd1-000-and-it-even-works-after-a-password-reset) - [Science & tech Articles | Mail Online — New Remus Stealer Malware Targets Gmail Accounts and Private Data](https://www.dailymail.com/sciencetech/article-16281307/gmail-remus-stealer-hacking-threat.html?ns_mchannel=rss&ns_campaign=1490&ito=1490) - [Security Affairs — Hackers Market $1,000 Tool Claiming Persistent Gmail Access](https://securityaffairs.com/202853/malware/hackers-advertise-a-1000-gmail-tool-that-allegedly-survives-password-resets.html) --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._