Hackers Claim Their Remus Gmail Snooping Tool Survives Password Resets

Recent findings from threat intelligence company Hudson Rock have brought to light an info-stealing malware called Remus Stealer, a tool being marketed to cybercriminals that can maintain persistent Gmail access even after a password reset. The company is calling bluff on the supposed claims, however.

Currently, the so-called gold standard advice for anyone caught in a data breach or any kind of compromised situation has been simply: change your password, sign out of all active sessions, and move on with your day. However, the developer of Remus says that it has rewritten the rules. Marketed on cybercrime forums under a hefty subscription model, Remus Stealer claims to let malicious operators peer into victim inboxes (via a stolen device record) from its own dashboard, bypassing traditional cookie theft methods.

However, cybersecurity researchers are questioning these claims. While the marketing hype from the malware developers is terrifying, folks at Hudson Rock and Malwarebytes point out that these claims are largely sales pitches rather than thoroughly verified zero-day exploits. Google maintains that no underlying Gmail vulnerability is being exploited; instead, these threats typically rely on lingering authorization artifacts or infected local environments on personal machines.

Even so, you shouldn't rely on a simple password swap if your system has been compromised. If you suspect your device has been touched by malware, your first move should be jumping onto a completely separate, clean device—like a phone or an uninfected laptop—to secure your accounts.

Once you are on safe ground, you need to go deeper than just updating your password—head into your Google account settings and dig through your connected third-party app permissions, account recovery phone numbers, backup emails, and active sessions. Crucially, check your Gmail settings for any unauthorized forwarding rules, custom filters, or email delegation. Attackers love to set up silent filters that automatically forward password resets or financial notifications to an external address while hiding the evidence from your primary view.

Finally, deal with the infected machine itself. Merely running a quick virus scan might not cut it if deep-seated mechanisms are at play. In a worst case scenario, it is often recommended to wipe the affected drive clean and reinstall the OS from scratch to ensure no hidden residue remains.