Remus Stealer 1.3.9 adds Gmail mailbox reading to its panel, with an unverified claim of access surviving password resets
Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 12/11/2026 00:00; os links antigos trazem para cá.
Fontes: malwarebytes.com ↗ securityaffairs.com ↗ infostealers.com ↗
Remus Stealer version 1.3.9 adds a Mail action to its panel that opens a compromised Gmail inbox directly from a stolen-device record (infostealers.com). The developer claims access continues after the victim changes the password or revokes sessions. A customer who publicly endorsed the feature told Hudson Rock that mail stayed available after a session reset and browser closure (infostealers.com). Hudson Rock did not validate the developer's Gmail "zero-day" description, and the correspondence only offers a tentative explanation for access after the malware exits (infostealers.com). The feature is sold as Enterprise-only at $1,000 per month and includes shareable mailbox links for other operators (infostealers.com). Later reports (securityaffairs.com, 2026-11-11; malwarebytes.com, 2026-11-11) describe it as a premium service and stress that the claim is unverified. They note that Hudson Rock did no reverse engineering or controlled post-recovery tests and that the material contains no independent technical proof. If continued retrieval of fresh mail is confirmed, the panel could collect recovery links and verification codes for accounts tied to the mailbox, so the risk is high even though the persistence claim is unproven (infostealers.com).
Detalhes técnicos
The developer described the mechanism only as interaction with browser memory, saying the software executes and then exits, and withheld the technical details needed for assessment (infostealers.com, malwarebytes.com). Hudson Rock's inference is that Remus obtains or establishes reusable authorization while it has access to a signed-in browser, and that a remote component requests mail afterwards. The material identifies no specific cookie, token, API, injection method or account-setting change (infostealers.com). The 1.3.9 announcement also claims interception of email verification codes without collecting browser cookie files, persistence across password changes and session revocation, and shareable mailbox-access links. These are seller marketing claims and are not independently demonstrated in the reviewed material (malwarebytes.com). Elsewhere, Remus is described as stealing cookies, authenticated session tokens and browser encryption keys, and theft of such session material can enable account access without a fresh password or MFA challenge (mallory.ai). Google's documentation says password changes ordinarily revoke OAuth access and refresh tokens carrying Gmail scopes. Apps Script is a documented exception, and existing OAuth IMAP connections last only as long as the access token's validity, usually about an hour (support.google.com). The screenshots show a webmail-style viewer with search, senders, subjects, timestamps, message lists and individual messages, reached through a Mail action beside each device record (infostealers.com, malwarebytes.com). The endorsing customer said they saw mailbox access continue after browser closure, session reset and a Google password change, but gave no timings, no details of which sessions were reset and no account settings, and the observation did not come from an independently controlled test (malwarebytes.com). Hudson Rock states it did not reverse engineer the feature or run controlled post-recovery validation, so survival of access after full account recovery (password change and token invalidation) remains unverified (malwarebytes.com). No CVE is assigned.
Remediação
- Isolate the infected endpoint, preserve relevant evidence and complete remediation before the device is used for trusted account access again (infostealers.com).
- Disconnect suspected infected devices from the internet and remove the malware before signing in again on them; run trusted security software or consider reinstalling the OS if necessary (malwarebytes.com).
- From a separate clean device, change compromised credentials (including the Google password), review signed-in devices and recent security events, and revoke suspicious sessions and application access without waiting for an endpoint rebuild (infostealers.com, malwarebytes.com).
- Review forwarding, filters, delegation, remote mail access, recovery email/phone and verification methods, and recent security activity on the mailbox (infostealers.com, malwarebytes.com).
- Prioritize dependent services that use the mailbox for sign-in or recovery (infostealers.com).
- No vendor fix exists for Remus, which is a criminal service, so the controls are containment and account hygiene (infostealers.com). Securityaffairs.com likewise advises standard security practices.
Relatos divergentes
The developer and the endorsing customer say access persists after a password change and session revocation (infostealers.com). Google's documentation says password changes ordinarily revoke Gmail-scoped OAuth tokens, with Apps Script as an exception (support.google.com). Google is the more authoritative source on how its own token handling normally works. Hudson Rock has not validated the persistence claim, and securityaffairs.com and malwarebytes.com (the more recent sources, both 2026-11-11) also call it unverified. Treat post-reset persistence as an unconfirmed claim by the malware seller, not an established capability.
The announcement claims verification codes are intercepted without collecting browser cookie files (malwarebytes.com), while another description says Remus steals cookies, session tokens and browser encryption keys (mallory.ai). The material does not reconcile the two, and the claim of cookie-less interception remains unverified.
Linha do tempo
-
Remus Stealer claims Gmail mailbox access survives password changes; capability unverified
ler a análise desta fonte ocultar
Remus Stealer developers advertise a Gmail-reading feature in version 1.3.9 that they claim can display and read a compromised mailbox from the malware service dashboard even after password changes and session revocation. Hudson Rock reviewed the promotional material and spoke with the developer and a self-described customer; the material includes screenshots of message lists, individual emails and a “Mail” option attached to compromised-device records but does not contain independent technical proof. The developer told Hudson Rock the feature interacts with browser memory and that the malware "executes and exits," and the announcement claims interception of verification codes without collecting browser cookie files and the ability to share mailbox access via links. Hudson Rock did not perform reverse engineering or controlled post-recovery tests and therefore does not validate that Remus can retrieve new messages after a comprehensive account recovery or that a Gmail zero-day exists (malwarebytes.com).
Technical Details
- The vendor announcement for Remus version 1.3.9 (advertised in the promotional material reviewed by Hudson Rock) shows a mailbox-reading interface in screenshots and lists features including mailbox viewing from a dashboard, interception of email verification codes without cookie collection, persistence across password changes and session revocation, and shareable mailbox-access links. These are marketing claims from the seller and are not independently demonstrated in the reviewed material (malwarebytes.com).
- The developer described the mechanism as involving interaction with browser memory and said the malware "executes and exits," but withheld technical details needed for assessment.
- A person who publicly endorsed the feature told Hudson Rock they observed continued mailbox access after browser closure, session reset, and a Google password change, but their statements lack documentation of timings, the exact sessions reset, account settings, and were not from an independently controlled test (malwarebytes.com).
- Hudson Rock explicitly states it did not reverse engineer the new feature or perform controlled post-recovery validation; therefore the claim that access survives a complete account recovery (password change and token invalidation) remains unverified (malwarebytes.com).
Remediation
- Use a separate, trusted device when beginning account recovery.
- Disconnect suspected infected devices from the internet and remove malware before signing in again on them.
- Change the Google password, review recent security events and signed-in devices, and remove unfamiliar access.
- Check applications with access to the account, device sessions, Gmail settings for unauthorized forwarding, filters, and delegated mailbox access, and verify recovery email/phone and verification methods.
- Run trusted security software on the affected device or consider reinstalling the OS if necessary.
- Review other accounts that rely on the compromised mailbox for recovery or verification (malwarebytes.com).
-
Hackers promote a $1,000/month tool claiming persistent Gmail access after password resets
ler a análise desta fonte ocultar
Cybersecurity firm Hudson Rock reports on a malicious tool linked to Remus Stealer that claims to maintain access to Gmail inboxes even after password changes and session revocations. The tool is marketed as a premium service to potentially facilitate ongoing account access, raising concerns about account recovery and multi-account breaches. However, this claim remains unverified, with significant uncertainties about its technical effectiveness and underlying vulnerabilities. Users are advised to follow standard security practices to mitigate potential risks.
-
Remus Stealer adds Gmail mailbox reading to its stolen-device panel, with an unverified post-reset persistence claim
ler a análise desta fonte ocultar
Remus Stealer advertises, in its version 1.3.9 announcement, a Mail action that opens a compromised Gmail inbox directly from a stolen-device record in its panel. The developer claims access continues after the victim changes the password or revokes sessions, and a customer who publicly endorsed the feature told Hudson Rock that mail remained available after a session reset and browser closure. Hudson Rock did not validate the developer's Gmail "zero-day" description, and the correspondence offers only a tentative explanation for access after the malware exits. The feature is listed as Enterprise-only at $1,000 per month and includes shareable mailbox links for other operators. If continued retrieval of fresh mail is confirmed, the panel could collect recovery links and verification codes for accounts tied to the mailbox, so the risk is high even though the persistence claim remains unverified.
Technical Details
The developer described the mechanism only as interaction with browser memory and said the software executes and exits. Hudson Rock's inference is that Remus obtains or establishes reusable authorization while it has access to a signed-in browser, and that a remote component requests mail afterwards; the material identifies no specific cookie, token, API, injection method or account-setting change. Elsewhere, Remus is described as stealing cookies, authenticated session tokens and browser encryption keys, and theft of such session material can enable account access without a fresh password or MFA challenge (mallory.ai). Google's documentation states that password changes ordinarily revoke OAuth access and refresh tokens carrying Gmail scopes, with Apps Script as a documented exception and existing OAuth IMAP connections limited to the access token's validity, usually about an hour (support.google.com). The screenshots show a webmail-style viewer with search, senders, subjects, timestamps and individual messages, reached through a Mail action beside each device record.
Remediation
Isolate the infected endpoint, preserve relevant evidence and complete remediation before the device is used for trusted account access again. From a separate clean device, change compromised credentials, review signed-in devices, and revoke suspicious sessions and application access without waiting for an endpoint rebuild. Review forwarding, filters, delegation, remote mail access, recovery methods and recent security activity on the mailbox, and prioritize dependent services that use it for sign-in or recovery. No vendor fix exists for Remus, which is a criminal service, and the material assigns no CVE, so the controls are containment and account hygiene.
Conflicting Reports
The developer and the endorsing customer say access persists after a password change and session revocation (infostealers.com). Google's documentation says password changes ordinarily revoke Gmail-scoped OAuth tokens (support.google.com), so the more authoritative source on token behaviour contradicts the claim for the paths it covers. The developer's Gmail "zero-day" framing is also not validated by Hudson Rock.