Changing your passwords is no longer enough to avoid this new cyberattack tool.
Gmail users should review their account security settings following reports of a new cybercrime tool designed to target private email inboxes.
The software, known as Remus Stealer, has been advertised on online forums as a tool that allows hackers to get their hands on unauthorized access to people’s personal emails, according to Hudson Rock, a cybersecurity company that investigated Remus Stealer.
The operators of the Remus Stealer malware are marketing a new capability that allows criminals to access victims’ Gmail inboxes directly from a control panel, according to insights from Cyber Insider. The developers of the software claim that cybercriminals can maintain access to messages even after users change their Google passwords or close their web browsers.
According to Hudson Rock, Remus Stealer says criminals who subscribe to their service — for $1,000 a month — will get access to private Gmail inboxes.
Infostealer malware is designed to collect sensitive data, such as passwords and login credentials, from infected devices. These infections typically occur through downloads, disguised as legitimate software, although the exact method Remus uses has not been confirmed.
Hudson Rock examined the version 1.3.9 announcement, contacted the developer, and spoke with a person who publicly endorsed the feature to learn more about the hacking software.
A user of Remus reported to Hudson Rock that compromised email access persisted for the hacker even after the user closed their browser and updated their account password.
The source also told Hudson Rock that verification codes from third-party online services could be intercepted through the application. Remus promotes email-code interception without collecting browser cookie files, claims that password changes and session revocation do not stop it, and advertises shareable mailbox links.
However, researchers have not independently verified whether ongoing message collection continues after an account is fully secured and active sessions are revoked.
Other online accounts may also be vulnerable, as unauthorized email access can allow individuals to receive password reset links and verification codes.
For the $1,000 monthly fee, hackers have a central dashboard to view email data and share access with other hackers.
Cybersecurity researchers at Hudson Rock reviewed promotional materials for the tool and noted that while updating passwords is a necessary precaution, additional security steps should be taken.
Images of the user interface show options to search email contents, sender details, and timestamps, indicating access to complete mailboxes rather than single codes.
Google recommends that users update their passwords and terminate unrecognized sessions. “Users can invalidate stolen sessions by removing malware from the affected device and revoking active sessions,” a Google spokesperson told Cybernews
Researchers advise users to review account settings, including forwarding rules, filters, recovery options, and third-party app permissions, to ensure no unauthorized changes have occurred.
The Post reached out to Hudson Rock and they did not immediately reply for comment.
