Remus Stealer 1.3.9 adds Gmail mailbox reading to its panel, with an unverified claim of access surviving password resets
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 11/11/2026 12:23; os links antigos trazem para cá.
Remus Stealer version 1.3.9 adds a Mail action to its panel that opens a compromised Gmail inbox directly from a stolen-device record (infostealers.com). The developer claims access continues after the victim changes the password or revokes sessions. A customer who publicly endorsed the feature told Hudson Rock that mail stayed available after a session reset and browser closure (infostealers.com). Hudson Rock did not validate the developer's Gmail "zero-day" description, and the correspondence only offers a tentative explanation for access after the malware exits (infostealers.com). The feature is sold as Enterprise-only at $1,000 per month and includes shareable mailbox links for other operators (infostealers.com). A later report (securityaffairs.com, 2026-11-11) also describes it as a premium service and stresses that the claim is unverified, with significant uncertainty about its technical effectiveness. If continued retrieval of fresh mail is confirmed, the panel could collect recovery links and verification codes for accounts tied to the mailbox, so the risk is high even though the persistence claim is unproven (infostealers.com).
Detalhes técnicos
The developer described the mechanism only as interaction with browser memory, saying the software executes and then exits (infostealers.com). Hudson Rock's inference is that Remus obtains or establishes reusable authorization while it has access to a signed-in browser, and that a remote component requests mail afterwards. The material identifies no specific cookie, token, API, injection method or account-setting change (infostealers.com). Elsewhere, Remus is described as stealing cookies, authenticated session tokens and browser encryption keys, and theft of such session material can enable account access without a fresh password or MFA challenge (mallory.ai). Google's documentation says password changes ordinarily revoke OAuth access and refresh tokens carrying Gmail scopes. Apps Script is a documented exception, and existing OAuth IMAP connections last only as long as the access token's validity, usually about an hour (support.google.com). The screenshots show a webmail-style viewer with search, senders, subjects, timestamps and individual messages, reached through a Mail action beside each device record (infostealers.com). No CVE is assigned.
Remediação
- Isolate the infected endpoint, preserve relevant evidence and complete remediation before the device is used for trusted account access again (infostealers.com).
- From a separate clean device, change compromised credentials, review signed-in devices, and revoke suspicious sessions and application access without waiting for an endpoint rebuild (infostealers.com).
- Review forwarding, filters, delegation, remote mail access, recovery methods and recent security activity on the mailbox (infostealers.com).
- Prioritize dependent services that use the mailbox for sign-in or recovery (infostealers.com).
- No vendor fix exists for Remus, which is a criminal service, so the controls are containment and account hygiene (infostealers.com). Securityaffairs.com likewise advises standard security practices.
Relatos divergentes
The developer and the endorsing customer say access persists after a password change and session revocation (infostealers.com). Google's documentation says password changes ordinarily revoke Gmail-scoped OAuth tokens, with Apps Script as an exception (support.google.com). Google is the more authoritative source on how its own token handling normally works. Hudson Rock has not validated the persistence claim, and securityaffairs.com (the more recent source, 2026-11-11) also calls it unverified. Treat post-reset persistence as an unconfirmed vendor-side claim by the malware seller, not an established capability.
Linha do tempo
-
Hackers promote a $1,000/month tool claiming persistent Gmail access after password resets
ler a análise desta fonte ocultar
Cybersecurity firm Hudson Rock reports on a malicious tool linked to Remus Stealer that claims to maintain access to Gmail inboxes even after password changes and session revocations. The tool is marketed as a premium service to potentially facilitate ongoing account access, raising concerns about account recovery and multi-account breaches. However, this claim remains unverified, with significant uncertainties about its technical effectiveness and underlying vulnerabilities. Users are advised to follow standard security practices to mitigate potential risks.
-
Remus Stealer adds Gmail mailbox reading to its stolen-device panel, with an unverified post-reset persistence claim
ler a análise desta fonte ocultar
Remus Stealer advertises, in its version 1.3.9 announcement, a Mail action that opens a compromised Gmail inbox directly from a stolen-device record in its panel. The developer claims access continues after the victim changes the password or revokes sessions, and a customer who publicly endorsed the feature told Hudson Rock that mail remained available after a session reset and browser closure. Hudson Rock did not validate the developer's Gmail "zero-day" description, and the correspondence offers only a tentative explanation for access after the malware exits. The feature is listed as Enterprise-only at $1,000 per month and includes shareable mailbox links for other operators. If continued retrieval of fresh mail is confirmed, the panel could collect recovery links and verification codes for accounts tied to the mailbox, so the risk is high even though the persistence claim remains unverified.
Technical Details
The developer described the mechanism only as interaction with browser memory and said the software executes and exits. Hudson Rock's inference is that Remus obtains or establishes reusable authorization while it has access to a signed-in browser, and that a remote component requests mail afterwards; the material identifies no specific cookie, token, API, injection method or account-setting change. Elsewhere, Remus is described as stealing cookies, authenticated session tokens and browser encryption keys, and theft of such session material can enable account access without a fresh password or MFA challenge (mallory.ai). Google's documentation states that password changes ordinarily revoke OAuth access and refresh tokens carrying Gmail scopes, with Apps Script as a documented exception and existing OAuth IMAP connections limited to the access token's validity, usually about an hour (support.google.com). The screenshots show a webmail-style viewer with search, senders, subjects, timestamps and individual messages, reached through a Mail action beside each device record.
Remediation
Isolate the infected endpoint, preserve relevant evidence and complete remediation before the device is used for trusted account access again. From a separate clean device, change compromised credentials, review signed-in devices, and revoke suspicious sessions and application access without waiting for an endpoint rebuild. Review forwarding, filters, delegation, remote mail access, recovery methods and recent security activity on the mailbox, and prioritize dependent services that use it for sign-in or recovery. No vendor fix exists for Remus, which is a criminal service, and the material assigns no CVE, so the controls are containment and account hygiene.
Conflicting Reports
The developer and the endorsing customer say access persists after a password change and session revocation (infostealers.com). Google's documentation says password changes ordinarily revoke Gmail-scoped OAuth tokens (support.google.com), so the more authoritative source on token behaviour contradicts the claim for the paths it covers. The developer's Gmail "zero-day" framing is also not validated by Hudson Rock.