An infostealer is selling Gmail inbox access it says survives a password change

The makers of Remus Stealer, a piece of malware sold to criminals to steal data from infected computers, are advertising a new feature: a built-in viewer for reading a victim’s Gmail inbox straight from the stolen data. Their sales pitch goes further, claiming access keeps working even after the victim changes their password or signs out of other sessions.

The threat intelligence firm Hudson Rock looked into the claims, talking to the developer and to a customer who vouched for the feature. Its conclusion is measured: the mailbox feature appears real, but the claim that it survives a full account recovery is unverified, and Hudson Rock doesn’t classify it as a Gmail security flaw.

What’s being advertised

According to Hudson Rock, the version 1.3.9 announcement promotes reading email codes without collecting browser cookie files, says password changes and session sign-outs don’t stop it, and offers shareable links so one criminal can hand an inbox to others. It’s sold only in Remus’s top “Enterprise” tier, which the main sales thread lists at $1,000 a month.

Screenshots supplied to Hudson Rock show a webmail-style viewer with senders, subjects, timestamps and search, attached to individual stolen-device records. One shows a verification code email from Pinterest. Remus’s marketing focuses on cryptocurrency services and YouTube accounts, but an inbox also receives password reset links for almost everything else.

What’s proven, and what isn’t

• Plausible: the developer told Hudson Rock the malware “interacts with browser memory” and then exits. Hudson Rock’s leading explanation is that Remus grabs or sets up reusable sign-in authorization while it’s on an infected computer with Gmail open, and a remote service then keeps fetching mail.
• Claimed, not shown: a customer told Hudson Rock that mail stayed readable after a session reset, browser closure and a Google password change. Hudson Rock notes he’s an interested party and gave no details of what was reset or when.
• Not established: Hudson Rock says the material contains no controlled test showing new mail arriving in Remus after a full recovery, and no malware analysis showing how it works. Google documents that a password change normally revokes tokens that can read Gmail, with some listed exceptions.

The developer calls it a Gmail “zero-day”. Hudson Rock says the evidence doesn’t support that. The key point for readers: the victim’s computer has to be infected first.

What you can do

1. Avoid the infection in the first place. Infostealers usually arrive through cracked software, fake game cheats, fake updates and malicious ads. Only install software from the vendor or an official store.
2. If you think a computer is infected, clean it or reset it before you sign in to anything on it again. Change passwords from a different, clean device. Changing a password on an infected computer can hand the new one straight to the malware.
3. After changing your Google password, review everything else, as Hudson Rock advises: sign out of unfamiliar devices in your Google Account’s security page, remove third-party apps you don’t recognize, and check Gmail settings for forwarding rules, filters or delegates you didn’t set up.
4. Secure accounts that use that inbox for resets. Turn on passkeys or an authenticator app where you can, so an emailed code alone isn’t enough to take an account over.

How Frame helps

This malware steals from infected computers rather than from a company database, so there isn’t a breach to add. Frame can look up your verified emails in Have I Been Pwned’s breach database for other breaches. Frame doesn’t scan devices for malware.

Related coverage

• How infostealers steal your sessions, and why a new password isn’t enough: the background on how stolen sessions work, and the clean-up steps that matter.
• A new infostealer goes after AI tool logins as well as passwords: another infostealer adding new targets this fall.

Sources

• Hudson Rock (InfoStealers), Remus Stealer Markets Persistent Gmail Access: Hudson Rock Investigates, November 2026
• Security Affairs, Hackers Advertise a $1,000 Gmail Tool That Allegedly Survives Password Resets, November 11, 2026