The operators of the Remus stealer malware are marketing a new capability that allows criminals to access victims' Gmail inboxes directly from a control panel, according to insights from Cyber Insider.
The developers claim this feature provides persistent access to email, even after users change passwords or revoke sessions. Remus is an information stealer designed to harvest credentials and sensitive data from infected systems. The new mailbox functionality is restricted to an enterprise tier priced at $1,000 per month. By integrating a mailbox viewer into the malware dashboard, attackers can conveniently browse messages, including verification codes and account recovery links.
While the developer asserts the method utilizes browser memory to maintain access, cybersecurity firm Hudson Rock has not yet verified these claims or identified a specific vulnerability. The potential impact is significant, as compromised inboxes often contain financial information and password-reset links for various services. Although the developer highlights cryptocurrency and YouTube accounts as primary targets, the threat extends to personal and workplace data. Security experts advise victims to secure accounts from clean devices and review Gmail settings for unauthorized forwarding rules or filters. Further investigation is required to determine if the access truly persists after comprehensive account recovery efforts.
Source: Cyber Insider
