Newshot Article title: Hackers Peddle $1,000-a-Month Gmail Tool Claiming Persistent Access Even After Password Changes
Body:
Recently, a hacker tool developer has been promoting a Gmail credential-stealing feature on underground channels, priced at $1,000 per month, claiming that even if victims change their passwords and revoke sessions, attackers can still maintain persistent access to the mailbox. The actual effectiveness of this feature has not yet been independently verified.
Remus Launches Persistent Mailbox Access Feature, Enterprise Edition Priced at $1,000 per Month
A report released by Hudson Rock states: "Remus Stealer is selling criminals an ability to directly open compromised Gmail inboxes through records from stolen devices. Its latest advertised feature goes further: operators claim that access remains valid even if the user changes their password or revokes sessions."
Remus Stealer is an infostealer, that is, malware specifically designed to steal data from infected devices. As advertised, attackers can use a searchable inbox feature directly within the control panel of stolen devices. Hudson Rock said the team has interviewed the tool's developer and an actual customer, who provided screenshots of the feature, including email content, timestamps, and control buttons for sharing the mailbox with other attackers.
If this claim is true, the risk extends far beyond the compromise of a single Gmail mailbox. Attackers can read password reset links and verification codes in emails, thereby taking over all other online accounts tied to that mailbox. Since the vast majority of internet services support resetting account passwords via Gmail, the potential harm of this feature is enormous.
The report also mentions: "In the disclosed version 1.3.9 announcement, Remus advertises that it can intercept email verification codes without collecting browser cookie files, claiming that changing passwords and revoking sessions cannot block its access, while also launching a shareable mailbox link feature. This feature is available only to Enterprise edition users, and the subscription price for this edition in the main sales post is $1,000 per month. The so-called sharing feature means attackers can use the service to open up already-captured inbox access to other operators. Existing materials do not show that victims become infected simply by clicking such links."
Implementation Mechanism Not Disclosed, Feature Effectiveness Unverified
The specific working mechanism of the tool remains unclear. Hudson Rock confirmed that Remus Stealer does not steal browser cookies; the developer only claims that changing the Gmail password will not block access, but has never disclosed specific technical details. The developer only mentioned that the malware interacts with browser memory, but this statement cannot explain why access remains valid after password changes and session revocation.
Hudson Rock speculates that Remus may obtain or generate an authorization token when the victim logs into Gmail through a browser. As long as Google still recognizes the token as valid, even if the malware has stopped running, the remote component can still use this authorization to access the user's emails. Tom's Guide reported that the tool can bypass Google's anti-fraud detection, and the outlet has contacted Google for comment.
However, reports from multiple media outlets point out that there are many uncertainties about the actual effectiveness of this feature. CyberInsider stated that Hudson Rock has not confirmed that the tool can indeed maintain access after the user changes their password, nor has it confirmed that the feature exploits a relevant Gmail vulnerability. Hudson Rock did not conduct controlled testing and cannot prove that Remus can still access newly received emails after the user changes their password, revokes existing sessions, and removes third-party app access. Cybernews mentioned that the developer described the feature as a Gmail 0Day, but no third party has independently reproduced and verified this claim.
Mainly Targeting High-Value Enterprise Targets, Users Need Basic Protection
The tool's business model is already relatively clear. CyberInsider confirmed that this persistent mailbox access feature is available only in the Enterprise edition, with a subscription price of $1,000 per month, and supports generating shareable mailbox links, making it convenient for attackers to hand over already-captured inbox access to other accomplices. The MaaS offered by the Remus Stealer operator is divided into three subscription tiers: Basic at $250 per month, Professional at $500 per month, and Enterprise at $1,000 per month.
Claims of this kind of persistent access are not new. In late 2023, a developer named PRISMA disclosed an exploit that regenerated persistent Google cookies by manipulating tokens and account IDs; Lumma malware subsequently used this capability to maintain account access after password resets. However, this is only a historical precedent and cannot serve as evidence that Remus's feature works, because the latter's implementation mechanism is currently completely unknown. Hudson Rock still regards changing the Google password as the core recovery step after account compromise, and also recommends that victims comprehensively investigate other paths through which attackers may retain access.
The tool is mainly marketed to "enterprise" customers; ordinary individual users are unlikely to become targets, and it is expected to mainly target various organizations and high-profile individuals. Hudson Rock recommends that users whose accounts have been compromised first disconnect and clean the infected computer before operating other trusted accounts; then use a clean device to change the passwords of all compromised accounts, check the list of logged-in devices for the account, and remove suspicious sessions and third-party app access.
Hudson Rock also reminds users to check Gmail settings for unauthorized changes, and to secure all other accounts tied to the compromised mailbox to prevent attackers from taking over these accounts through verification codes or reset links. Conventional basic protection measures remain effective: be wary of phishing emails with urgent content, spelling errors, or suspicious sender addresses, and keep antivirus software up to date. Tom's Guide believes that if the tool's actual effectiveness is truly as the developer advertises, Google will most likely roll out additional Gmail security protection mechanisms.
Currently, all relevant information comes only from the vendor's marketing claims. Although there are customer-provided screenshots and Hudson Rock's preliminary investigation as support, this does not prove that Gmail itself has a confirmed security vulnerability. One key detail may give users some reassurance: attackers must first infect the victim's device and capture initial mailbox access before they can use this persistent access tool.
The report concludes: "Remus is advertising its integrated mailbox reading capability, and customers have already endorsed its claimed persistent access effect. The most reasonable speculation at present is that the tool reuses access obtained or established during endpoint compromise. Existing evidence neither clarifies its specific implementation mechanism nor proves that attackers can still access newly received emails after users complete comprehensive account recovery."
Hackers Advertise a $1,000 Gmail Tool That Allegedly Survives Password Resets