Remus Stealer Malware Claims Persistent Gmail Access Post-Password Change
The Remus Stealer malware is reportedly advertising a feature that allows continued access to compromised Gmail accounts even after a password reset and session revocation, though independent verification is pending.
The latest iteration of the Remus Stealer malware, version 1.3.9, is making a bold claim: it can maintain access to a victim's Gmail account even after the user has changed their password and revoked active sessions. This feature, if proven true, would represent a significant challenge to account recovery processes and could allow attackers to continue exfiltrating sensitive information long after a compromise is detected.
According to a report by threat intelligence firm Hudson Rock, promotional materials for Remus Stealer v1.3.9 showcase an interface that allegedly allows operators to directly access a compromised Gmail mailbox from the service's dashboard. The advertised capabilities include intercepting email verification codes without needing to steal browser cookies, bypassing the security measure of password changes and session revocations, and even sharing mailbox access with other operators via links.
The developer of Remus Stealer reportedly described the mechanism as an interaction with browser memory, allowing the malware to execute and exit without leaving a significant trace. Furthermore, the developer asserted that this method circumvents Google's anti-fraud checks. However, these are marketing claims from the seller of a malicious service and have not been independently verified.
Hudson Rock did engage with an individual who publicly endorsed the feature, and this source claimed that mailbox access persisted even after browser closure, session resets, and a Google password change. Crucially, though, the correspondence lacked specific details about the exact sessions reset, account configurations, or the precise timing of the password change and subsequent access. The source's independence was not established, and their statements were not accompanied by a controlled testing environment.
Hudson Rock explicitly stated that its analysis did not include reverse engineering of the new feature or controlled post-recovery validation. This leaves the core claim of persistent Gmail access unproven. While Google's documentation indicates that password changes ordinarily invalidate access and refresh tokens used by third-party applications, the exact method Remus Stealer might employ to bypass this remains unclear.
Regardless of the unverified claims, the incident serves as a stark reminder that recovering a compromised account involves more than just changing a password. Users who suspect their Gmail account has been compromised should take a comprehensive approach to securing their account. This includes using a trusted device to initiate the recovery process, disconnecting the infected device from the internet, and thoroughly reviewing account security settings.
Security best practices for affected users involve changing their Google password, scrutinizing recent security events and active device sessions, and removing any unfamiliar access. It is also vital to inspect Gmail settings for unauthorized forwarding rules, filters, delegated mailbox access, or changes to remote mail access. Users should also verify their recovery email, phone number, and other verification methods.
While the specific persistence mechanism of Remus Stealer remains unverified, the potential for advanced malware to circumvent standard security protocols highlights the ongoing need for robust security software and vigilant user practices. Real-time anti-malware protection is essential in preventing infections by information stealers like Remus.