Somewhere between a criminal's sales pitch and a technology giant's flat denial, a quiet and unsettling question has drifted through the week's security coverage: can a stolen-data tool called Remus keep a grip on someone's Gmail after that person has changed the password? The answer, for now, rests on what the sellers themselves claim and on nothing independently proven. It is a familiar modern drama in miniature, where the promise of a product and the reassurance of its maker collide, and where the ordinary person's trusted shield, the password reset, is suddenly asked to prove it still hold
Malware Claims Persistent Gmail Access After Password Resets; Google Denies a Security Flaw
An advertised capability set against a company's flat denial
Mark
So what is actually being claimed here?
Mimi
That the Remus stealer, a credential-stealing malware, now offers persistent Gmail access that supposedly survives a password reset. It's reportedly sold for about $1,000 a month.
Mark
Why does the password part matter so much?
Mimi
Because resetting a password is what most people do first when they think they've been hacked. If that doesn't cut off an attacker, the standard advice has a hole in it.
Luke
Before we go further, who is making this claim?
Mimi
The attackers selling the tool. That's the source.
Luke
Right, so it's a sales pitch. Criminals have reasons to exaggerate what they sell. Has anyone independent confirmed it?
Mimi
Not in the coverage we have. Nothing cited shows a verified exploit.
Mark
And Google's response?
Mimi
It denies there's a security flaw in Gmail.
Luke
Worth noting that a denial isn't proof either. It tells us Google says nothing is broken, not that the tool doesn't work some other way, such as through stolen session data on an infected machine. That's my guess, though, and the reporting doesn't say it.
Mark
Then what should a regular person do?
Mimi
Sign out of all sessions after changing a password and turn on 2-step verification. It's cheap and it helps whichever side turns out to be right.
Luke
And we don't know how many people, if any, have been affected. That number is missing.
Der Puls
- A password reset, the reflexive shield against a hacked account, is suddenly being called into question.
- Sellers of the Remus stealer advertise persistent Gmail access for about $1,000 a month, and that claim is ricocheting across major outlets.
- Google flatly denies any security flaw, leaving a sharp gap between attacker boasts and the company's position.
- No independent researcher has verified the behavior, so the story hangs on an advertised capability rather than a proven exploit.
- The practical response is taking shape: end active sessions on every device and switch on 2-step verification while the facts remain unsettled.
Somewhere between a criminal's sales pitch and a technology giant's flat denial, a quiet and unsettling question has drifted through the week's security coverage: can a stolen-data tool called Remus keep a grip on someone's Gmail after that person has changed the password? The answer, for now, rests on what the sellers themselves claim and on nothing independently proven. It is a familiar modern drama in miniature, where the promise of a product and the reassurance of its maker collide, and where the ordinary person's trusted shield, the password reset, is suddenly asked to prove it still holds.
This week a cluster of headlines from several outlets has carried an alarming claim: a malware tool known as Remus stealer, which harvests credentials and account data from infected computers, can supposedly keep reading a person's Gmail even after the owner changes the password. Its sellers say they have added a feature for persistent access, and they price it at about $1,000 a month.
The claim cuts close because a password reset is the usual first move when someone fears their account has been breached. If that move no longer ends the intrusion, ordinary advice falls short. Some headlines even labeled it a Google zero-day, a flaw the vendor does not yet know about, which raised the stakes further.
Google denies that Gmail has any security flaw, and the coverage frames the company as insisting nothing in its product is broken. The reporting, however, rests almost entirely on what the attackers say their tool can do. No confirmed vulnerability or independent verification has been cited, and the source material does not explain how the access would work, how many people might be affected, or whether any account has actually been taken over this way.
The practical guidance is clear enough regardless. After any password change, end active sessions on all devices, and turn on 2-step verification. What to watch next is whether an independent researcher confirms the behavior or Google issues an advisory. Until then, this is a criminal advertisement set against a firm corporate denial.
A cluster of headlines this week, from the New York Post, Tom's Guide, Cybernews, SC Media and The 420.in, has circled the same unsettling claim: that a piece of malware can keep reading a person's Gmail even after the owner changes their password.
The tool at the center of it is called Remus stealer, a type of malware built to harvest credentials and account data from infected computers. According to the reports, its sellers have added a feature that they say gives persistent access to Gmail accounts. The price attached to it is about $1,000 a month.
The claim matters because a password reset is the standard first response when someone suspects an account has been compromised. If access truly survives that step, the usual advice would not be enough on its own. Some headlines went further and described the claim as a Google zero-day, a term for a flaw the vendor does not yet know about or has not yet fixed.
Google, however, denies that there is any security flaw. The company's position, as the coverage frames it, is that nothing in Gmail itself is broken. The SC Media headline puts the two sides in one line: the stealer claims Gmail access after password changes, and Google denies a flaw.
That gap is the heart of the story. The reporting rests on what the attackers themselves say their product can do. It does not rest on a confirmed vulnerability, and no independent verification has been cited in the headlines. The Cybernews framing is careful on this point, saying attackers say they have access, not that researchers have shown it.
The source material is thin on mechanics. It does not explain how the persistent access would work, how many people may be affected, or whether any account has actually been taken over this way. Those are open questions, and the coverage as summarized does not answer them.
What the reports do offer is practical guidance. Google is quoted in the headlines as urging users to protect their inboxes, and the sensible steps that follow from the claim are to end active sessions on all devices after a password change and to turn on 2-step verification.
What to watch next is whether an independent security researcher confirms the behavior, or whether Google issues an advisory addressing it. Until one of those happens, this remains an advertised capability from criminal sellers, set against a company's flat denial.
Bemerkenswerte Zitate
Google denies there is a security flaw in Gmail.— Google, as reported by SC Media
Möchten Sie die ganze Geschichte?
Das Original lesen bei Google News ↗