Remus Stealer Claims Persistent Gmail Access, but Recovery Resistance Remains Unverified
Summary
Hudson Rock reviewed Remus Stealer’s advertised Gmail feature and interviewed its developer and a customer. Their accounts suggest access may outlast the stealer process, but no controlled test shows fresh mail remains accessible after comprehensive account recovery; a
Key points
- Remus Stealer’s version 1.3.9 advertises a mailbox viewer integrated into stolen-device records, with email-code interception and shareable mailbox links.
- The developer described browser-memory interaction and said the software exits; a customer claimed access continued after browser closure, a session reset, and a password change.
- Those accounts are not independent technical validation. No controlled test shows fresh mail being retrieved after comprehensive password, session, and application-access revocation.
- Hudson Rock did not establish the access mechanism or demonstrate a Gmail zero-day. Reuse of authorization acquired during endpoint compromise is a possible explanation, not a confirmed finding.
- The article recommends isolating and remediating the infected endpoint, securing accounts from a clean device, revoking suspicious access, and checking mailbox and recovery settings.
Article Details
- Event Type
- Hudson Rock investigated Remus Stealer’s advertised mailbox-access feature and its unverified claims of continued access after password changes or session revocation.
- Impact
- The feature could expose mailbox contents and verification or recovery messages if the reported access works, potentially enabling further account takeovers. The supplied evidence does not establish the access mechanism, a Gmail zero-day, or retrieval of new mail after comprehensive account recovery.