Developers behind an infostealing malware strain called Remus Stealer are advertising a capability that has drawn serious attention in the security community. They claim that, for $1,000 per month, operators can read victims’ Gmail inboxes even after the victims change their Google passwords.
Claimed features of Remus Stealer
According to the description cited in the report, Remus Stealer allegedly:
- Intercepts email verification codes without stealing browser cookie files,
- Maintains mailbox access even after password changes and session revocations,
- Interacts with browser memory, then executes and exits.
Hudson Rock co-founder Alon Gal wrote on LinkedIn that they spoke directly with the developer of the malware and with someone publicly vouching for the service. Based on these conversations, a customer reportedly claims that mailbox access continues after the browser is closed and even after a Google password change.
“Gmail zero-day” label
Gal notes that the developer refers to this capability as a Gmail “zero-day”. The claim implies the existence of an undisclosed weakness affecting Gmail access.
The information presented is limited to these statements from the malware’s developer, a customer, and Gal’s summary. The article does not include any technical validation of the exploit or any official comment from Google.
Source: Gündəm · cybernews.com
