Remus Stealer Sells Alleged Persistent Gmail Access for $1,000 a Month

Overview

• Hudson Rock reviewed promotional materials and spoke with the developer and a user who showed screenshots of a searchable dashboard that reportedly lets buyers read compromised Gmail inboxes and share access with others.
• The operator advertises the service as a subscription costing about $1,000 per month and pitches features that aim to let criminals intercept password-reset links and two-factor codes from victims' email.
• Researchers have not independently verified the claim that the tool continues collecting messages after accounts are fully secured and active sessions are revoked, and the developer has not provided technical details of the persistence mechanism.
• Google tells users to remove malware from infected devices and revoke active sessions to invalidate stolen access, and experts advise changing passwords from a clean device and auditing forwarding rules, filters, recovery options, and third-party app access.
• The case reflects a wider malware-as-a-service trend that targets higher-value accounts by monetizing stolen inboxes and raises the real risk that email compromise can lead to takeover of banking, shopping, and social accounts.