Remus Stealer Claims to Give Hackers Access to Gmail Inboxes

Remus Stealer is being marketed to cybercriminals as software for accessing Gmail inboxes through a control panel. Its operators claim that access can persist after a user changes a Google password or closes a browser, and that the tool can capture verification messages from other online services.

Hudson Rock examined promotional material, contacted the software’s developer and spoke with someone who said they had used it. Screenshots showed a dashboard with email search functions and sender and timestamp details. The tool is advertised for $1,000 per month, with mailbox access that can be shared with other users.

The person who described using the service said it remained accessible even after they shut a browser and changed a password. But researchers have not independently confirmed whether the software can keep collecting new messages after an account is fully secured and unauthorized sessions are revoked. They also have not established how Remus infects devices. Infostealers commonly spread through downloads disguised as legitimate software.

Google said there is no Gmail or Google vulnerability involved, and described session-stealing malware as an existing type of threat. The company advises users to remove malware from affected devices, change passwords and revoke suspicious active sessions.

Hudson Rock also recommends reviewing signed-in devices, forwarding rules, filters, recovery settings and third-party app permissions. Users should secure other accounts that depend on Gmail for password resets or verification. Google recommends Enhanced Safe Browsing in Chrome and passkeys for stronger account security.