Google Warns New Remus Stealer Malware Bypasses Standard Account Security

Google has issued a security warning regarding a newly discovered infostealer malware known as "Remus Stealer", which is currently being marketed on underground cybercrime forums. According to a report published by the New York Post, citing findings from cybersecurity firm Hudson Rock, the malicious software allows threat actors to compromise personal email accounts and harvest sensitive data even after victims have changed their passwords.

The developers of the tool reportedly offer cybercriminals access to private inboxes via a dedicated system for a monthly subscription fee of 1,000 USD. Through this interface, attackers can allegedly read messages, search for sensitive data, and intercept email-based verification codes, posing a severe threat to interconnected accounts.

What makes this malware particularly concerning is the claim that standard remediation steps, such as updating account credentials, closing browsers, and revoking active sessions, may not be sufficient to lock out the attackers. While Hudson Rock researchers gathered testimonies indicating that unauthorized access persisted despite password changes, they noted that these claims have not yet been independently verified in fully secured scenarios.

Infostealers are typically deployed through malicious downloads disguised as legitimate software, though the exact initial vector for Remus Stealer remains under investigation. Once inside an inbox, attackers can leverage password recovery links and authentication codes to compromise secondary accounts across other platforms.

To mitigate these risks, Google advises users to update their credentials, terminate unrecognized sessions, and completely remove any malicious software from infected devices. Security experts also recommend auditing inbox settings to ensure no unauthorized forwarding rules, suspicious filters, or altered recovery options have been implemented.