Remus Stealer Claims Persistent Gmail Access After Password Changes

• •Remus Stealer claims to maintain Gmail access after password changes.
• •The malware's new feature allows reading inboxes directly from its control panel.
• •Hudson Rock has not confirmed the claims or identified a Gmail vulnerability.

Remus Stealer, an infostealer malware, is promoting a feature that allegedly allows attackers to access victims' Gmail inboxes even after password changes and session revocations. This feature, marketed at $1,000 per month, enables operators to read emails, including verification codes and recovery links, directly from the malware's control panel. Hudson Rock, a cybersecurity firm, has investigated these claims but has not confirmed the existence of a Gmail vulnerability that would allow such persistent access. The developer asserts that the malware interacts with browser memory, enabling continued access after the malware exits. However, no controlled tests have validated these claims, leaving the actual effectiveness of the feature unproven. Users are advised to secure their accounts from clean devices and follow Google's recovery guidance.