Ethical Hacking News
Unraveling the Shadows of Cybercrime: A $1,000 Gmail Tool Allegedly Survives Password Resets
Remus Stealer is a $1,000-per-month tool that gives criminals continuous access to Gmail inboxes, even after a password change. The tool can keep reading a victim's mailbox after a password change, after the browser closes, and after sessions are revoked. The tool may obtain or create an authorization token while the victim is logged into Gmail, allowing for continued access. Google is a valuable target because many online services use it to recover accounts, making it essential to take precautions to protect Gmail accounts. Experts recommend disconnecting and cleaning the infected computer, changing passwords using a clean device, and reviewing signed-in devices for suspicious sessions.
Hackers have been exploiting the vulnerabilities of the internet for quite some time now, but recently, a new tool emerged that has left many security experts scratching their heads. The tool, known as Remus Stealer, is a $1,000-per-month feature that allegedly gives criminals continuous access to Gmail inboxes, even after a password change. The tool is marketed towards "enterprise" customers, meaning most users are unlikely to be targeted, but it will probably be used mainly against organizations and high-profile individuals.
According to cybersecurity firm Hudson Rock, the tool can keep reading a victim's mailbox after a password change, after the browser closes and after sessions are revoked. The developer of the tool, Remus Stealer, claims that changing the Gmail password does not stop access. However, the developer has not shared technical details, and Hudson Rock believes that the tool may obtain or create an authorization token while the victim is logged into Gmail through a browser. A remote component could then use this authorization to access emails even after the malware has stopped running, as long as Google continues to accept it.
The tool has been described as a Gmail "zero-day," but this claim has not been independently reproduced. The business side is more concrete, with the mailbox feature sitting in an Enterprise tier at $1,000 per month, with shareable mailbox links so criminals can hand an inbox they've already compromised to others. The actor behind Remus Stealer offers the MaaS with three subscription tiers: Basic at $250, Pro at $500, and Enterprise at $1,000.
The emergence of this tool has raised concerns among security experts, who warn that it could be used to read password reset links and verification codes, allowing attackers to access other accounts linked to that email address. Gmail is a valuable target because many online services use it to recover accounts. To mitigate this risk, Hudson Rock recommends that victims first disconnect and clean the infected computer before accessing their trusted accounts again. They should then change compromised passwords using a clean device and review their signed-in devices to remove suspicious sessions and third-party access.
Other basic precautions remain important: watch out for phishing emails with urgent messages, spelling mistakes or suspicious sender addresses, and keep antivirus software up to date. Tom's Guide expects Google to introduce additional Gmail protections if the tool proves as effective as its developer claims.
In the past, similar tools have emerged, and while this one may be more sophisticated, it is essential to remember that the evidence does not identify the mechanism or show fresh mail remaining accessible after comprehensive recovery. The most plausible broad model is reuse of access obtained or established during endpoint compromise.
The emergence of such tools highlights the ongoing cat-and-mouse game between hackers and security experts. While the hackers may have an edge in terms of sophistication, security experts are working tirelessly to stay one step ahead. The key to staying safe lies in being aware of these risks and taking proactive measures to protect oneself.
Related Information:
https://www.ethicalhackingnews.com/articles/Unraveling-the-Shadows-of-Cybercrime-The-1000-Gmail-Tool-Allegedly-Surviving-Password-Resets-ehn.shtml
https://securityaffairs.com/202853/malware/hackers-advertise-a-1000-gmail-tool-that-allegedly-survives-password-resets.html
https://www.tomsguide.com/computing/malware-adware/dangerous-new-gmail-exploit-lets-hackers-read-your-emails-for-a-monthly-fee-of-usd1-000-and-it-even-works-after-a-password-reset
Published: Wed Nov 11 08:22:14 2026 by llama3.2 3B Q4_K_M
