Cybersecurity firm Hudson Rock is investigating Remus Stealer, whose developers advertise a mailbox-access feature through a $1,000 monthly subscription. The feature targets accounts accessed through infected devices.
Screenshots supplied to researchers show a searchable inbox displaying messages, senders, and timestamps. The seller also advertises the ability to intercept email verification codes and share mailbox access with other operators.
That could put more than private conversations at risk. An exposed inbox can contain password-reset links and security codes for other accounts.
But a critical claim remains unproven.
Hudson Rock says it has not verified that attackers can retrieve newly arriving messages after a victim fully secures the account, including changing passwords and revoking sessions and application access. The researchers have not established a previously unknown Gmail vulnerability.
Google told Cybernews that no Gmail or Google vulnerability is involved. The company described malware targeting sign-in sessions on personal devices as an existing threat.
The distinction matters for anyone trying to regain control of an account.
If malware remains on a computer, changing a password there can allow the malicious software to capture the new sign-in session, Google explained.
The company advises removing malware first, then resetting passwords and revoking unrecognized sessions. Use a separate, clean device to secure accounts while an infected computer is being cleaned.
Google’s compromised-account recovery guide recommends checking account activity and signed-in devices, removing unfamiliar access, and running trusted antivirus software.
Gmail settings deserve attention, too. Remove forwarding rules or filters you did not create, and review who has permission to access the mailbox. Check recovery phone numbers and email addresses for unauthorized changes.
Google also recommends stronger sign-in protection, including passkeys or two-step verification. Those protections should accompany device cleanup and a review of account access.
Check back with Daily Voice for the latest updates.
Click here to follow Daily Voice and receive free news updates.
