Remus Stealer developer markets persistent Gmail access for $1,000

On 11 November 2026 Security Affairs reports that a hacking-tools developer is marketing a feature of the Remus Stealer that allegedly provides persistent access to Gmail inboxes for $1,000 per month. Hudson Rock, a cybersecurity firm, says the tool offers a way for criminals to read a compromised inbox directly from a stolen-device dashboard and claims that access continues after a password change, browser closure and session revocation.

The material includes screenshots and mentions a “Enterprise” tier with mailbox sharing, suggesting the capability could be extended to multiple operators.

The evidence surrounding the claim is mixed and unverified. The Remus developer has not provided technical details, and Hudson Rock notes that it has not conducted controlled tests to confirm persistence after password resets or post-revocation access. Tom’s Guide and CyberInsider report that the feature is marketed as a Gmail “zero-day” by some sources, though independent reproduction is lacking.

The sales outline lists three tiers—Basic at $250, Pro at $500 and Enterprise at $1,000 per month—and describes shareable mailbox links, which could enable reusing access across operators. Hudson Rock cautions that victims should disconnect infected devices, change passwords from a clean device, review signed-in devices and third-party access, and monitor for unauthorized Gmail changes, while noting the uncertainty over the exact mechanism and urging restraint until independent verification.

The article emphasises that, as of now, this remains a marketing claim rather than a confirmed Gmail vulnerability, with the attacker needing initial infection and mailbox compromise to exploit it.