A developer of hacking tools is advertising a $ 1,000-per-month feature that allegedly lets bad actors have continuous access to vulnerable Gmail inboxes. The report from the cybersecurity firm Hudson Rock claims the tool can keep accessing victims' Gmail inboxes even after password changes, browser closure and session revocations.
If this is true, it means that hackers could get access to password reset links, verification codes and therefore access to other accounts.
The malware, called Remus Stealer, supposedly gives bad actors a searchable inbox directly inside a stolen dashboard.
Hudson Rock says it spoke with the developer and a customer, who used the tool and provided them with screenshots of email messages, timestamps and control for sharing an impacted mailbox with other operators.
How the hack works
Per the security firm, the email-intercepting tool doesn't collect browser cookie files and Remus claims that password changes do not stop it.
It somehow avoids Google's anti-fraud checks, though the developer didn't give Hudson Rock any technical details, for obvious reasons. Remus did say that it interacts with browser memory. This doesn't explain how it survives password changes or session revocation though.
“The leading broad explanation is that Remus acquires or establishes reusable authorization while it has access to a signed-in browser. A remote component could then request mail after the local executable exits, for as long as the service accepts that authorization,” Hudson Rock wrote in its report.
Tom's Guide reached out to Google about this tool and will update this article if and when the company responds.
How to stay safe
The tool is advertised for "enterprise" customers, so most people should be safe from the damage it can do. It most likely will be used to target organizations and high level individuals. Plus, the mailbox needs to be compromised already before the tool can be utilized.
But, if you somehow find yourself impacted by this infostealer here are some recommended steps from Hudson Rock:
- Isolate the infected computer and clean it before accessing trusted accounts again
- Change compromised passwords on a clean device
- Review signed-in devices and revoke suspicious session and third-party access
- Check your Gmail settings for unauthorized changes
- Secure other accounts that use the compromised mailbox for password resets or verification
As for protecting your email before the tool can even be applied, make sure you're on guard against phishing attacks. Scammers like to instill a sense of urgency, and their emails often have red flags like misspelled words or poor grammar. Of course, you should double-check the sender's email address too.
To keep your computer safe from malware and other viruses that could come from opening a phishing email, it's important to install the best antivirus software on your PC, the best Mac antivirus software on your Mac and one of the best Android antivirus apps on your Android smartphone.
If this new tool is as effective as the hackers behind it claim, Google will likely introduce additional protections inside Gmail to keep both its business and ordinary users safe.
Follow Tom's Guide on Google News and add us as a preferred source to get our up-to-date news, analysis, and reviews in your feeds.
More from Tom's Guide
