Dangerous new Gmail exploit lets hackers read your emails for a monthly fee of $1,000 — and it even works after a password reset
Latest from Tom's Guide ·
Scott Younker is the West Coast Reporter at Tom’s Guide. He covers all the latest tech news, including phones, computing and more. He’s been involved in tech since 2011 covering everything from cameras and swimming pool equipment to the latest gaming consoles and smart TVs. He is on a seemingly never ending hunt to build the easiest to use home media system. Before Tom’s Guide, Scott worked for publications like Digital Trends, Outdoor Photographer, Dead Beats Panel , and in a brief detour, America’s Funniest Home Videos . Yes, he has seen more pratfalls, silly pets and ridiculous home movie fails than is reasonably healthy. When not writing about the latest devices or advances in chipsets, be sure to ask about Scott about disc golf and sustainability, or just if you’re being cheeky, ask about his noodle arm. If you truly want to get nerdy, bring up board games and his ongoing losing streak. Scott joined Tom's Guide in 2024 as the West Coast Reporter. He graduated from the School of Journalism at the University of Oregon with a degree in magazine journalism and a minor in communications. While there he blogged or wrote for several magazines including the Fluxx, Ethos and the Oregon Commentator. He briefly wrote and managed a moderately successful blog focused on web comics. Send secure tips on Signal: scyo1.55.
A developer of hacking tools is advertising a $ 1,000-per-month feature that allegedly lets bad actors have continuous access to vulnerable Gmail inboxes. The report from the cybersecurity firm Hudson Rock claims the tool can keep accessing victims' Gmail inboxes even after password changes, browser closure and session revocations.
If this is true, it means that hackers could get access to password reset links, verification codes and therefore access to other accounts.
The malware, called Remus Stealer, supposedly gives bad actors a searchable inbox directly inside a stolen dashboard.
Hudson Rock says it spoke with the developer and a customer, who used the tool and provided them with screenshots of email messages, timestamps and control for sharing an impacted mailbox with other operators.
Per the security firm, the email-intercepting tool doesn't collect browser cookie files and Remus claims that password changes do not stop it.
It somehow avoids Google's anti-fraud checks, though the developer didn't give Hudson Rock any technical details, for obvious reasons. Remus did say that it interacts with browser memory. This doesn't explain how it survives password changes or session revocation though.
“The leading broad explanation is that Remus acquires or establishes reusable authorization while it has access to a signed-in browser. A remote component could then request mail after the local executable exits, for as long as the service accepts that authorization,” Hudson Rock wrote in its report.
Tom's Guide reached out to Google about this tool and will update this article if and when the company responds.
The tool is advertised for "enterprise" customers, so most people should be safe from the damage it can do. It most likely will be used to target organizations and high level individuals. Plus, the mailbox needs to be compromised already before the tool can be utilized.
But, if you somehow find yourself impacted by this infostealer here are some recommended steps from Hudson Rock:
As for protecting your email before the tool can even be applied, make sure you're on guard against phishing attacks. Scammers like to instill a sense of urgency , and their emails often have red flags like misspelled words or poor grammar . Of course, you should double-check the sender's email address too.
To keep your computer safe from malware and other viruses that could come from opening a phishing email, it's important to install the best antivirus software on your PC, the best Mac antivirus software on your Mac and one of the best Android antivirus apps on your Android smartphone.
If this new tool is as effective as the hackers behind it claim, Google will likely introduce additional protections inside Gmail to keep both its business and ordinary users safe.