$1,000-a-Month Remus Stealer Claims Unstoppable Gmail Access

Threat actors are paying $1,000 a month for a malware subscription that claims it can hold onto Gmail inboxes even after victims change their passwords. Hudson Rock, the cybersecurity firm that flagged the tool, says the latest version of Remus Stealer works differently from typical infostealers — and Google says the real weakness isn't its mail service at all.

What does Remus Stealer actually claim to do?

Hudson Rock laid out the malware's pitch in a blog post. The most recent version of Remus, the company wrote, "promotes email-code interception without collecting browser cookie files, claims that password changes and session revocation do not stop it, and advertises shareable mailbox links."

That's a bold shift. Traditional infostealers grab browser cookies and stored credentials, which users and platforms can neutralize by resetting passwords and killing active sessions. Remus markets itself as immune to those countermeasures — and it adds a resale angle, letting criminals share direct mailbox links with buyers.

The price point matters too. At $1,000 per month, Remus positions itself as a premium cybercrime product rather than a one-off purchase, suggesting a maturing market where hacking tools come with subscriptions and support.

The takeaway: criminals are now selling persistent inbox access as a service, and they're charging premium rates for the persistence.

How did Google respond?

Google moved quickly to reframe the story. A company spokesperson told Inc. that attacks using infostealer malware to target session tokens on personal devices are "not new."

"There is no Gmail or Google vulnerability at play here. We routinely upgrade our built-in defenses to protect users against session theft and automatically secure accounts when we detect suspicious activity," the spokesperson said.

Google characterized the situation as ongoing third-party infostealer activity hitting personal devices across the web — not an attack specific to Gmail or Google. The company also pointed to a fix users can run themselves: removing the malware from the affected device and revoking active sessions through Google's device activity page signs users out of stolen sessions.

The takeaway: Google's position is that the infection lives on the victim's machine, so the cleanup has to start there.

How big is the underlying problem?

The data-breach backdrop explains why inbox access sells. The Identity Theft Resource Center defines a data breach as "when unauthorized individuals access and/or remove personal information from the place where it is stored." In 2024, the organization found that 84 percent of compromised data was classified as sensitive, including financial and medical information.

Verizon's Data Breach Investigations Report puts email even higher on attackers' lists: email addresses are compromised in 61 percent of all data breaches, and passwords are exposed in 28 percent of cases. A live mailbox is a gateway to password resets, verification codes and account recovery across every service a victim uses.

Is this new territory for Google?

Not really. In 2025, Google warned in a report that a prolific hacking group was targeting Gmail and notified affected users by email. "We believe threat actors using the 'ShinyHunters' brand may be preparing to escalate their extortion tactics by launching a data leak site (DLS)," Google said at the time. A year earlier, the company had flagged a well-known group of hackers targeting users as well.

Google is also extending its defenses into the AI era. In a September blog post, the company said it would add support to its intelligence systems and block malicious users.

"Our multifaceted defense strategy integrates proactive model-level safeguards, specialized threat intelligence, and targeted containment protocols to protect our customers and infrastructure," Google said. "We continuously harden our models against misuse, mitigate malicious activity through proactive disruption of bad actor projects and accounts, and use our autonomous Google AI Threat Defense architecture to operationalize security across enterprise environments."

The takeaway: whether the flaw sits in Gmail or on the device, the market for stolen inboxes keeps growing — and Google's response now spans everything from session revocation to autonomous AI threat defense.