Phoenix 24
Stolen sessions reveal a growing challenge in digital security.
SAN FRANCISCO, California. A newly promoted feature of the Remus Stealer malware has raised concerns among cybersecurity researchers after its developers claimed that attackers could continue accessing compromised Gmail accounts even after users changed their passwords or closed active sessions. The allegations highlight a potentially serious security risk, although independent investigators have not verified the full extent of the claimed capability.
Cybersecurity intelligence company Hudson Rock examined Remus Stealer version 1.3.9, an information-stealing program designed to extract sensitive data from infected computers. Its developers are advertising a feature that allows cybercriminals to view and search compromised Gmail inboxes through a dedicated dashboard.
The service is reportedly marketed through an enterprise subscription costing approximately $1,000 per month. Promotional materials suggest that operators can examine email messages, retrieve verification codes and share mailbox access with other users.
Unlike conventional password theft, the suspected technique involves obtaining authorization information from an authenticated browser session. Such information can sometimes allow attackers to access online services without entering the original password again.
Remus developers claim that their software briefly interacts with browser memory, retrieves the information necessary to maintain access and exits without triggering security systems. However, they have not disclosed sufficient technical evidence to establish how the method works.
Hudson Rock interviewed the malware developer and a purported customer but did not conduct controlled testing or reverse engineering capable of confirming the most significant claims.
Consequently, researchers have not demonstrated that Remus can continue reading newly received emails after a compromised account has been fully secured and unauthorized sessions revoked.
Google has disputed suggestions that the malware exploits a previously unknown Gmail vulnerability. The company maintains that session theft involving infected devices is an established cybersecurity threat and that users can invalidate compromised sessions by removing malicious software and revoking unauthorized access.
The distinction is important because changing a password remains an essential security measure. However, it may be insufficient when malicious software remains installed or attackers have established alternative access through connected applications, forwarding rules or compromised authentication sessions.
Security specialists recommend isolating infected devices, removing malware and changing passwords from a trusted computer. Users should also review active sessions, connected applications, recovery settings and Gmail forwarding configurations.
Additional protections include multifactor authentication, passkeys and avoiding suspicious downloads.
The emerging threat illustrates how cybercriminals increasingly target the mechanisms that maintain authenticated sessions rather than relying exclusively on stolen passwords.
For individuals and organizations, effective account protection now requires a broader approach combining device security, authentication management and continuous monitoring of unauthorized activity.
Beyond the Headlines, the Digital Security Challenge.