'Remus Stealer'... New Breach That May Expose Private 'Gmail' Messages
Experts warn of Remus Stealer malware, which steals Gmail messages and bypasses passwords, while Google denies a new security vulnerability.
Translated by Qiyas from الراي — Original source
“Russia Today” – Cybersecurity experts have warned Gmail users about a malware known as “Remus Stealer,” which allows hackers to secretly access private email messages and continue reading them even after the password has been changed.
The malware is advertised on hacking forums as a tool for searching through victims’ email inboxes. Hackers claim they can continue reading messages even after the victim changes their Google password or closes their browser, potentially leaving the account compromised without the owner’s knowledge. The threat extends beyond email, as stolen password-reset links and verification codes could grant access to bank accounts, social media profiles, and other services.
The tool is offered as part of a monthly subscription priced at $1,000, complete with a control panel to view messages and share inbox access with other hackers.
Researchers from Hudson Rock investigated the claims after reviewing promotional materials and speaking with the software’s developer and a user. They found screenshots showing an interface that displays messages, sender information, send times, and search functions, suggesting the tool is designed to expose entire mailboxes rather than just individual security tokens.
However, the company emphasized that it has not independently verified whether hackers can access new messages after victims have fully secured their accounts, nor has it confirmed the tool’s mechanism, which the developer claims interacts with browser memory before closure.
Google denied that the malware exploits an unknown vulnerability in Gmail, noting that attacks targeting session tokens (temporary data that keeps users logged in) via information-stealing software are not new, and that it regularly updates its defenses. It is believed that criminals obtain information from infected devices where users are logged into Gmail, with infections potentially occurring through malicious downloads disguised as legitimate software.
If the claims hold true, criminals could intercept financial information, personal correspondence, and password-reset links, potentially compromising other accounts such as shopping and social media profiles, as well as work-related emails containing confidential documents and financial records. However, available evidence does not prove that the tool bypasses all security measures or maintains indefinite access.
- Secure bank accounts, shopping accounts, and social media accounts that rely on Gmail for password resets or verification.
