Hackers Could Keep Reading Your Emails Even After You Change Your Gmail Password, Researchers Warn

Cybercriminals seems to have found another way to exploit compromised Gmail accounts. A new investigation by Hudson Rock reveals that Remus Stealer is advertising a mailbox-reading feature. It reportedly lets attackers access stolen Gmail inboxes through a dedicated panel, even after the original malware stops running.

Remus Stealer turns compromised inboxes into another attack surface

Hudson Rock dug deep into Remus Stealer version 1.3.9 and contacted its developer. The investigation also included conversations with a customer who publicly endorsed the feature. The advertised tool displays a webmail-style inbox inside Remus’s stolen-device panel. Screenshots show message lists, senders, timestamps, search options, and individual emails.

This is concerning because inboxes often contain password-reset links and verification codes. Access could potentially expose accounts beyond the original compromised device. Remus reportedly markets the feature as an Enterprise-only addition. Its advertised subscription costs $1,000 per month.

The developer told Hudson Rock that the feature interacts with browser memory before executing and exiting. A customer also claimed mailbox access continued after browser closure and a Google password change. That claim remains unverified. Hudson Rock found no controlled demonstration showing attackers receiving fresh emails after comprehensive account recovery.

No confirmed Gmail zero-day, but the threat deserves attention

Hudson Rock believes Remus may reuse authorization obtained during an infected-device compromise. However, investigators have not identified the exact mechanism or confirmed persistent access after effective revocation. Google documents that password changes ordinarily revoke access and refresh tokens carrying Gmail permissions. Certain exceptions exist, but they do not establish that Remus exploits them. The investigation also does not demonstrate a universal MFA bypass or complete control over connected accounts.

For users and organizations, the immediate priority is securing compromised devices and accounts. Google account owners should review signed-in devices, revoke suspicious application access, and inspect mailbox forwarding rules and recovery settings. Speaking of the wider infostealer market, Remus appears to be packaging mailbox access into its existing stolen-data workflow. That could make compromised inboxes more valuable to cybercriminals.