Remus Stealer claims Gmail mailbox access survives password changes; capability unverified
Remus Stealer developers advertise a Gmail-reading feature in version 1.3.9 that they claim can display and read a compromised mailbox from the malware service dashboard even after password changes and session revocation. Hudson Rock reviewed the promotional material and spoke with the developer and a self-described customer; the material includes screenshots of message lists, individual emails and a “Mail” option attached to compromised-device records but does not contain independent technical proof. The developer told Hudson Rock the feature interacts with browser memory and that the malware "executes and exits," and the announcement claims interception of verification codes without collecting browser cookie files and the ability to share mailbox access via links. Hudson Rock did not perform reverse engineering or controlled post-recovery tests and therefore does not validate that Remus can retrieve new messages after a comprehensive account recovery or that a Gmail zero-day exists (malwarebytes.com).
Detalhes técnicos
- The vendor announcement for Remus version 1.3.9 (advertised in the promotional material reviewed by Hudson Rock) shows a mailbox-reading interface in screenshots and lists features including mailbox viewing from a dashboard, interception of email verification codes without cookie collection, persistence across password changes and session revocation, and shareable mailbox-access links. These are marketing claims from the seller and are not independently demonstrated in the reviewed material (malwarebytes.com).
- The developer described the mechanism as involving interaction with browser memory and said the malware "executes and exits," but withheld technical details needed for assessment.
- A person who publicly endorsed the feature told Hudson Rock they observed continued mailbox access after browser closure, session reset, and a Google password change, but their statements lack documentation of timings, the exact sessions reset, account settings, and were not from an independently controlled test (malwarebytes.com).
- Hudson Rock explicitly states it did not reverse engineer the new feature or perform controlled post-recovery validation; therefore the claim that access survives a complete account recovery (password change and token invalidation) remains unverified (malwarebytes.com).
Remediação
- Use a separate, trusted device when beginning account recovery.
- Disconnect suspected infected devices from the internet and remove malware before signing in again on them.
- Change the Google password, review recent security events and signed-in devices, and remove unfamiliar access.
- Check applications with access to the account, device sessions, Gmail settings for unauthorized forwarding, filters, and delegated mailbox access, and verify recovery email/phone and verification methods.
- Run trusted security software on the affected device or consider reinstalling the OS if necessary.
- Review other accounts that rely on the compromised mailbox for recovery or verification (malwarebytes.com).
Linha do tempo
-
Remus Stealer claims Gmail mailbox access survives password changes; capability unverified
ler a análise desta fonte ocultar
Remus Stealer developers advertise a Gmail-reading feature in version 1.3.9 that they claim can display and read a compromised mailbox from the malware service dashboard even after password changes and session revocation. Hudson Rock reviewed the promotional material and spoke with the developer and a self-described customer; the material includes screenshots of message lists, individual emails and a “Mail” option attached to compromised-device records but does not contain independent technical proof. The developer told Hudson Rock the feature interacts with browser memory and that the malware "executes and exits," and the announcement claims interception of verification codes without collecting browser cookie files and the ability to share mailbox access via links. Hudson Rock did not perform reverse engineering or controlled post-recovery tests and therefore does not validate that Remus can retrieve new messages after a comprehensive account recovery or that a Gmail zero-day exists (malwarebytes.com).
Technical Details
- The vendor announcement for Remus version 1.3.9 (advertised in the promotional material reviewed by Hudson Rock) shows a mailbox-reading interface in screenshots and lists features including mailbox viewing from a dashboard, interception of email verification codes without cookie collection, persistence across password changes and session revocation, and shareable mailbox-access links. These are marketing claims from the seller and are not independently demonstrated in the reviewed material (malwarebytes.com).
- The developer described the mechanism as involving interaction with browser memory and said the malware "executes and exits," but withheld technical details needed for assessment.
- A person who publicly endorsed the feature told Hudson Rock they observed continued mailbox access after browser closure, session reset, and a Google password change, but their statements lack documentation of timings, the exact sessions reset, account settings, and were not from an independently controlled test (malwarebytes.com).
- Hudson Rock explicitly states it did not reverse engineer the new feature or perform controlled post-recovery validation; therefore the claim that access survives a complete account recovery (password change and token invalidation) remains unverified (malwarebytes.com).
Remediation
- Use a separate, trusted device when beginning account recovery.
- Disconnect suspected infected devices from the internet and remove malware before signing in again on them.
- Change the Google password, review recent security events and signed-in devices, and remove unfamiliar access.
- Check applications with access to the account, device sessions, Gmail settings for unauthorized forwarding, filters, and delegated mailbox access, and verify recovery email/phone and verification methods.
- Run trusted security software on the affected device or consider reinstalling the OS if necessary.
- Review other accounts that rely on the compromised mailbox for recovery or verification (malwarebytes.com).