Remus Stealer claims Gmail access survives password changes

Malwarebytes reports that the Remus Stealer developers are marketing a Gmail-reading feature that they claim can survive a password change and session revocation. The vendor’s announcement, dated version 1.3.9, shows a mailbox-reading interface accessible from the operator’s dashboard, with screens of message lists, individual emails and a “Mail” option linked to compromised devices.

The marketing also claims operators can intercept verification codes without cookies, that password changes and session revocation do not stop access, and that mailbox access can be shared with other operators via links. Hudson Rock, after reviewing the material, cautions that while the screenshots depict a mailbox-reading interface, they do not demonstrate Remus’s ability to retrieve new messages after comprehensive account security measures, nor do they establish a Gmail zero-day vulnerability.

The evidence from Hudson Rock includes a single external source who publicly endorsed the feature and described continued mailbox access after a browser closure, a session reset and a password change. That account, however, does not document which sessions were reset, the precise settings involved, or the timing of the password change relative to access. Hudson Rock notes that its report did not include reverse engineering of the feature or controlled post-recovery validation.

Google’s documentation indicates that ordinary password changes invalidate access and refresh tokens used by applications with Gmail permissions, so token theft alone does not prove persistence for Remus.

The article also outlines practical steps for suspected infections: use a separate device, disconnect and clean infections before signing in again, change Google password, review security events and devices, check apps with access, investigate Gmail forwarding and recovery options, and run trusted security software.