jordan pulse : AMMAN
​Cybersecurity experts have issued a warning to Gmail users regarding a newly emerging info-stealing malware known as 'Remus Stealer.' The malicious tool allegedly grants hackers unauthorized access to private email messages, with developers claiming it maintains persistence even after users change their passwords.
​Nature of the Threat
​Marketed on dark web hacking forums as a search and extraction tool for target inboxes, the developers of Remus Stealer claim the malware allows operators to continue reading incoming messages after a victim changes their Google password or closes their browser session. Beyond accessing email content, stolen password-reset links and verification codes could potentially expose linked financial accounts, social media profiles, and corporate services.
​The malware operates under a subscription-based model priced at $1,000 per month, featuring a control dashboard that displays messages and enables operators to share inbox access with third parties.
​Findings from Security Researchers
​Researchers at cybersecurity firm Hudson Rock analyzed promotional materials and conducted interviews with both a developer and a user of the tool. Investigation revealed dashboard screenshots displaying complete inbox messages, sender details, timestamps, and search functionality—indicating that the malware is designed to target entire inbox environments rather than isolated security tokens.
​However, Hudson Rock emphasized that it has not independently verified whether the tool can maintain access to new messages after a user fully secures their account via standard security protocols. The tool's developer claims it interacts directly with browser memory prior to session termination.
​Official Response from Google
​Google denied that Remus Stealer exploits an unpatched or zero-day vulnerability within Gmail. The company stated that attacks targeting session tokens—temporary data files that keep users logged into their accounts—via info-stealing malware are an established threat vector, noting that Google continuously updates its defensive infrastructure.
​Google indicated that perpetrators typically acquire session data from previously compromised devices where users remained logged into their accounts, often stemming from malicious downloads disguised as legitimate software.
​Risk Assessment & Recommended Safeguards
​While current evidence does not conclusively prove the tool bypasses all security protections indefinitely, compromised accounts risk exposure of financial data, personal communications, password-reset links, and confidential workplace documents.
​Security experts advise users to take the following protective measures:
​Isolate Compromised Devices: Change passwords using a secondary, secure device.
​Audit Active Sessions: Review logged-in devices and revoke permissions for unauthorized apps or third-party extensions.
​Inspect Account Settings: Check for unauthorized changes in mail forwarding rules, automated filters, or recovery details.
​Secure Linked Accounts: Update credentials for banking, e-commerce, and social media platforms linked to the affected Gmail address.
​Enable Enhanced Protection: Activate Enhanced Safe Browsing settings within Google Chrome.
​Source: Rum News Agency

jordan pulse : AMMAN
​Cybersecurity experts have issued a warning to Gmail users regarding a newly emerging info-stealing malware known as 'Remus Stealer.' The malicious tool allegedly grants hackers unauthorized access to private email messages, with developers claiming it maintains persistence even after users change their passwords.
​Nature of the Threat
​Marketed on dark web hacking forums as a search and extraction tool for target inboxes, the developers of Remus Stealer claim the malware allows operators to continue reading incoming messages after a victim changes their Google password or closes their browser session. Beyond accessing email content, stolen password-reset links and verification codes could potentially expose linked financial accounts, social media profiles, and corporate services.
​The malware operates under a subscription-based model priced at $1,000 per month, featuring a control dashboard that displays messages and enables operators to share inbox access with third parties.
​Findings from Security Researchers
​Researchers at cybersecurity firm Hudson Rock analyzed promotional materials and conducted interviews with both a developer and a user of the tool. Investigation revealed dashboard screenshots displaying complete inbox messages, sender details, timestamps, and search functionality—indicating that the malware is designed to target entire inbox environments rather than isolated security tokens.
​However, Hudson Rock emphasized that it has not independently verified whether the tool can maintain access to new messages after a user fully secures their account via standard security protocols. The tool's developer claims it interacts directly with browser memory prior to session termination.
​Official Response from Google
​Google denied that Remus Stealer exploits an unpatched or zero-day vulnerability within Gmail. The company stated that attacks targeting session tokens—temporary data files that keep users logged into their accounts—via info-stealing malware are an established threat vector, noting that Google continuously updates its defensive infrastructure.
​Google indicated that perpetrators typically acquire session data from previously compromised devices where users remained logged into their accounts, often stemming from malicious downloads disguised as legitimate software.
​Risk Assessment & Recommended Safeguards
​While current evidence does not conclusively prove the tool bypasses all security protections indefinitely, compromised accounts risk exposure of financial data, personal communications, password-reset links, and confidential workplace documents.
​Security experts advise users to take the following protective measures:
​Isolate Compromised Devices: Change passwords using a secondary, secure device.
​Audit Active Sessions: Review logged-in devices and revoke permissions for unauthorized apps or third-party extensions.
​Inspect Account Settings: Check for unauthorized changes in mail forwarding rules, automated filters, or recovery details.
​Secure Linked Accounts: Update credentials for banking, e-commerce, and social media platforms linked to the affected Gmail address.
​Enable Enhanced Protection: Activate Enhanced Safe Browsing settings within Google Chrome.
​Source: Rum News Agency

https://www.jordanpulse.com/article/19172