Remus Stealer is advertising a $1,000-a-month feature that allegedly lets criminals keep reading compromised Gmail inboxes after password changes and session revocation. Security Affairs reported on November 11 that cybersecurity firm Hudson Rock examined the offering, but the claimed persistence remains unverified. For victims of an infected computer, the practical concern is continued access to email used to recover other accounts.
Attackers must first infect the victim’s computer and compromise the mailbox before using the feature. Remus is an infostealer—malware that collects data from infected computers—and its advertised mailbox reader sits inside a dashboard of stolen-device records. Its “Enterprise” label describes a subscription tier, rather than establishing which organizations or people have been targeted.
What the evidence supports
Security Affairs says Hudson Rock spoke with the developer and a customer who reported using the feature. The customer provided screenshots showing messages, timestamps and a control for sharing mailbox access with other operators. The developer claims access survives password changes, browser closure and revocation of sessions, the authorizations that keep users signed in.
The version 1.3.9 announcement advertises interception of email verification codes without collecting browser cookie files, which commonly hold sign-in information. It also promotes shareable mailbox links. Those links purportedly give another operator access to an inbox already acquired through the service; the material does not show someone becoming infected by opening one.
The mailbox feature is advertised only in the Enterprise tier, priced at $1,000 per month. Security Affairs also lists Basic at $250 and Pro at $500 for the malware-as-a-service offering, in which customers pay to use the criminal software.
Access to incoming messages could extend the damage beyond Gmail. For example, an attacker who can read a password-reset link or verification code could use it to take over another account tied to that address.
How persistence might work
The developer says Remus interacts with browser memory but has not disclosed a technical mechanism. Hudson Rock’s proposed explanation is that it obtains or creates an authorization token—a credential allowing access—while the victim is signed into Gmail. A remote component might then read email after the malware stops running, for as long as Google accepts that authorization.
That remains a hypothesis. Security Affairs cites CyberInsider as reporting that Hudson Rock has neither confirmed persistence after a password change nor established exploitation of a Gmail vulnerability. A controlled test demonstrating access to newly received mail after password changes, session revocation and removal of third-party access has not been conducted. Cybernews reported that the developer calls the feature a Gmail “zero-day,” meaning a previously unknown vulnerability, but that claim has not been independently reproduced.
Tom’s Guide also reported a claimed ability to bypass Google’s anti-fraud checks and said it had contacted Google for comment. Its expectation of additional Google protections depends on the tool proving effective.
There is a relevant precedent: in late 2023, a developer called PRISMA surfaced an exploit that regenerated persistent Google cookies using a token and account-ID pair, which Lumma subsequently used to retain access after password resets. That history does not establish how Remus works.
Recovery starts with the infected computer
Hudson Rock still considers a Google password change essential to recovery. It recommends that victims first disconnect and clean the infected computer, then change compromised passwords from a clean device before returning to trusted accounts.
Users should review signed-in devices, remove suspicious sessions and third-party access, and check Gmail settings for unauthorized changes. The report also advises keeping antivirus software current and watching for phishing messages with urgent demands, spelling errors or suspicious sender addresses. Anyone whose mailbox was compromised should also secure other accounts that use it for password resets or verification codes.
