Remus Stealer Sells Searchable Gmail Access for $1,000 a Month

Overview

• Hudson Rock reviewed promotional screenshots and direct messages tied to Remus Stealer’s version 1.3.9 and reported that the malware is being offered as a subscription service with an “Enterprise” tier priced at about $1,000 per month that shows a searchable mailbox dashboard.
• The developer and a user told researchers the tool can keep reading a compromised Gmail inbox after a victim changes their password, closes the browser, or revokes sessions, and the marketing materials advertise shareable links to hand off stolen mailboxes to other criminals.
• Google disputed that a new Gmail vulnerability has been proven and told reporters that the primary remedies are removing malware from infected devices and revoking active sessions and third‑party access to invalidate stolen credentials.
• Independent researchers have not reproduced the developer’s persistence claim and the precise technical method or the scale of real-world abuse remain unverified, so the report rests on marketing materials, screenshots, and developer/user statements rather than controlled tests.
• Security advice for anyone who may be affected includes cleaning the infected device before signing in, changing passwords from a trusted device, reviewing signed‑in sessions, checking forwarding rules and recovery options, and using stronger multi-factor methods such as passkeys or security keys.