The developers of the Remus Stealer malware claim to offer persistent access to compromised Gmail accounts for $1,000 per month, including after a password change or session revocation. Hudson Rocks examined the offer and found screenshots showing an interface for browsing and searching emails and sharing access to a compromised account. However, the researchers say they have not independently established a Gmail “zero-day” vulnerability or confirmed that new emails remain accessible after a complete account recovery. A more likely explanation is that the malware retrieves or establishes a reusable authorization from an already compromised browser, although this does not demonstrate persistence after effective revocation. Hudson Rocks recommends cleaning the infected device, changing credentials from a trusted device, reviewing active sessions and authorized applications, and securing other linked accounts, particularly those used for cryptocurrency or financial services.
Source: Read the original article
