Thought Leadership
The infostealer reportedly can access Gmail inboxes even after password changes. Hudson Rock has not confirmed a Gmail zero-day vulnerability.
The developers behind the Remus Stealer malware are advertising a new feature that supposedly allows cybercriminals to read their victims’ Gmail inboxes directly from the malware’s control panel. The service costs USD 1,000 per month. According to its providers, access is supposed to persist even after victims close their browsers, change their Google passwords, or terminate their active sessions. The offering was investigated by Israeli cybersecurity firm Hudson Rock, which specializes in infostealer malware.
“The customer claims mailbox access continues after the browser closes and even after a Google password change. The developer calls it a Gmail ‘zero-day.’”
Hudson Rock
How the Feature Works Remains Unclear
Unlike many infostealers, Remus reportedly does not rely on stealing browser cookie files. According to the developer, the feature accesses the browser’s memory while the malware is running. No technical details have been disclosed. This could explain why attackers might retain access to an inbox even after the malware itself has been terminated. However, it does not explain how that access could survive a password change. If the capability works as advertised, attackers could potentially intercept password reset links and verification codes for other accounts as well.
No Zero-Day Vulnerability Confirmed
Hudson Rock does not consider the feature a confirmed Gmail zero-day vulnerability. The company has not conducted a controlled test to determine whether new emails continue reaching Remus after a password change and the revocation of all sessions and app access. According to Google’s documentation, changing a password normally revokes access and refresh tokens with Gmail permissions. However, Google lists exceptions, including certain devices and connected applications. Whether Remus exploits one of these exceptions remains unclear. Google has not yet commented on the claims.
Secure the Device Before Changing the Password
Anyone affected should first clean the infected device and then change their password from a secure device. Otherwise, the new password could be stolen again. Next, users should go to the Security section of their Google Account, terminate all unfamiliar sessions, and review third-party apps with account access. In Gmail, they should check forwarding settings, filters, and delegated access. They should also verify their account recovery email address and phone number. According to Google, passkeys can make these attacks more difficult because they cannot be stolen in the same way as passwords.
(Editorial Team)
