Gmail users are being urged to review their account security settings following reports of a new cybercrime tool designed to target private email inboxes and potentially expose sensitive personal information.
The malware, known as Remus Stealer, is being advertised on online forums as a tool that allows hackers to gain unauthorised access to users’ personal email accounts, according to cybersecurity company Hudson Rock, which has investigated its capabilities.
Operators behind Remus Stealer are promoting a new feature that allegedly allows cybercriminals to access victims’ Gmail inboxes directly through a central control panel, Cyber Insider reports.
The software’s developers claim that hackers can maintain access to compromised email accounts even after users change their Google passwords or close their internet browsers.
According to Hudson Rock, the service is being offered to cybercriminals through a subscription costing approximately $1,000 per month.
Infostealer malware is designed to collect sensitive information from infected devices, including passwords and account login credentials. Such infections commonly occur when users download malicious programmes disguised as legitimate software. However, the exact method used by Remus Stealer has not yet been independently confirmed.
Hudson Rock examined promotional material for version 1.3.9 of the software, contacted its developer and spoke with an individual who had publicly supported the new feature in an effort to establish how the tool operates.
One Remus Stealer user reportedly told Hudson Rock that a hacker had maintained access to a compromised email account even after the victim closed the browser and changed their account password.
The same source claimed that the application could also intercept verification codes from other online services. Remus reportedly promotes the ability to capture codes delivered through email without needing to collect browser cookies.
The developers further claim that changing passwords and closing active sessions may not be sufficient to terminate the unauthorised access. The software also reportedly allows hackers to generate links through which compromised inboxes can be shared with other individuals.
However, cybersecurity researchers have not independently verified whether access to email messages can continue after an account has been fully secured and all active sessions have been terminated.
The potential threat extends beyond Gmail itself. Access to a victim’s email account could allow hackers to intercept password-reset links and verification codes used to access other online services.
For the monthly subscription fee of $1,000, users reportedly receive access to a centralised control panel where they can view email information and share access with other hackers.
Screenshots of the software’s interface suggest that it allows operators to search email content, examine sender information and check when messages were received. This indicates that the tool may provide access to entire inboxes rather than merely capturing individual verification codes.
Google has advised users to change their passwords and terminate sessions they do not recognise.
“Users can invalidate stolen sessions by removing the malware from the affected device and terminating active sessions,” a Google spokesperson told Cybernews.
Meanwhile, Hudson Rock researchers recommend that users take additional precautions by carefully reviewing their account security settings.
These include checking:
- Email forwarding rules and filters for unauthorised changes.
- Account recovery options and contact details.
- Permissions granted to third-party applications.
- Active sessions and devices connected to the account.
- Any suspicious activity involving login credentials.
Cybersecurity experts stress that changing a password is an important step, but removing malware from an infected device and reviewing all account permissions are also essential to restoring security.
