Gmail users are being urged to take precautions over a newly advertised hacking threat that could give criminals covert access to private messages.
The malware, called Remus Stealer, is being promoted on underground forums as a service that allegedly lets criminals search Gmail inboxes, read personal correspondence and intercept security codes for other online accounts.
The claims are particularly concerning because the operators say access may continue even after victims change their Google passwords or close their browsers, potentially allowing compromised accounts to remain under surveillance.
Beyond email privacy, stolen password-reset links and verification codes could put banking services, social media accounts and other online platforms at risk.
The software is reportedly being offered through a subscription costing $1,000 a month. Its dashboard allegedly allows customers to monitor messages from compromised inboxes and share access with other hackers.
Cybersecurity researchers at Hudson Rock examined the claims by reviewing promotional material and speaking with the malware’s developer and an individual who said they had used the service.
Google has advised potentially affected users to change their passwords and revoke unfamiliar login sessions. ‘Users can invalidate stolen sessions by removing malware from the affected device and revoking active sessions,’ a Google spokesperson told Cybernews.
Hudson Rock also stressed that although changing a password is vital, it may not be enough if attackers have created other routes into the account.
Stolen password-reset links and verification codes could potentially expose victims’ bank accounts, social media profiles and other online services—not just their private emails
Screenshots reviewed by the researchers appeared to show an interface containing email content, sender details, timestamps and search tools. That suggests the advertised service is intended to expose complete inboxes, rather than only isolated security messages.
Hudson Rock cautioned, however, that it has not independently confirmed whether the operators can continue retrieving newly received messages after victims secure their accounts completely.
Google rejected suggestions that the campaign relies on a previously undisclosed Gmail security vulnerability.
‘There is no Gmail or Google vulnerability at play here,’ a Google spokesperson told Cybernews. Our News Outlet has reached out to Google for comment.
The company said malware that steals active login sessions is an established type of attack and that its security systems are continually updated to defend against such threats.
Researchers suspect the criminals may be extracting data from infected computers while their owners are signed in to Gmail.
The malware’s developer told Hudson Rock that the program interacts with browser memory before shutting down, which could allegedly enable messages to be retrieved remotely after the malware is no longer running.
Researchers have not independently established whether that claimed capability works as described.
Remus Stealer is reportedly sold for $1,000 a month, with a dashboard that allegedly lets criminals view messages from compromised inboxes and share access with other hackers
Infostealers are types of malware built to harvest sensitive data, including passwords and other login credentials, from infected devices.
They can spread through malicious downloads disguised as genuine software, although investigators have not determined how Remus Stealer reaches victims.
A person who claimed to have used the service told Hudson Rock that access to a mailbox continued after the browser had been closed and the associated Google password changed.
The source also claimed that the tool could display verification messages sent by various online services.
Even so, researchers have not confirmed whether attackers can obtain new emails after a victim has fully secured the account and revoked unauthorized sessions.
If the allegations are accurate, criminals could intercept financial details, private correspondence and password-reset links used to take over additional accounts.
For instance, an intercepted verification email might help an attacker enter a victim’s shopping or social media account, depending on the safeguards protecting that service.
Business inboxes could also be exposed, including confidential documents, financial records and other sensitive work-related information.
Hudson Rock said the advertised sharing function could enable several criminals to access the same compromised mailbox.
However, the evidence currently available does not show that the tool can defeat every security control or preserve access indefinitely.
Hudson Rock advised users to isolate infected computers and change compromised passwords from a separate device known to be secure.
They should also inspect the devices signed in to their accounts, terminate unfamiliar sessions and remove unauthorized third-party application permissions.
Researchers urged Gmail users to look for unexpected changes to email forwarding rules, filters, recovery settings and permissions granted to other users.
People who may be affected should also protect banking, shopping and social media accounts that use their Gmail address for password resets or verification.
Google also recommends turning on Enhanced Safe Browsing in Chrome to help prevent malicious downloads and using passkeys for stronger account protection.
