Google’s “zero-day”: Attackers say they have access to Gmail even after password change

A $1,000/month allegedly allows you to read victims’ Gmail inboxes even after they change their Google passwords. At least that's what the hackers say.

Developers of an infostealing malware strain called Remus Stealer say one of its features allows operators to intercept email verification codes without stealing browser cookie files. It also reportedly maintains mailbox access following password changes and session revocations.

The advertised feature gives operators a searchable inbox directly inside Remus's stolen-device dashboard.

Screenshots published by cybersecurity firm Hudson Rock, which first reported on the malware, show email messages, senders, timestamps, and a control for sharing mailbox access with other operators.

Operators of the malware can select a compromised computer log, open its associated mailbox, search messages, and share mailbox access through the service.

“We spoke directly with the developer and someone publicly vouching for the service. The developer says the malware interacts with browser memory, executes, and exits,” Hudson Rock co-founder Alon Gal wrote in a LinkedIn post.

“The customer claims mailbox access continues after the browser closes and even after a Google password change. The developer calls it a Gmail ‘zero-day,’” he added.

If the advertised persistence works as described, attackers could continue receiving password reset links and verification messages, potentially using them to compromise associated accounts. This poses serious security risks to users.

We reached out to Google to comment and will update the article once we receive a reply.

How could Remus maintain Gmail access?

Remus could obtain or establish reusable authorization while the victim is logged into Gmail via a compromised browser. When asked how the feature works, the Remus developer pointed to interaction with browser memory and said the software executes and exits.

This mechanism would explain how mailbox access might continue without the original executable running continuously. However, it does not automatically explain why access would survive effective revocation of the stolen authorization.

The developer also claimed that customers had verified the feature's effectiveness and that it bypasses Google's anti-fraud checks.

“The leading broad explanation is that Remus acquires or establishes reusable authorization while it has access to a signed-in browser. A remote component could then request mail after the local executable exits, for as long as the service accepts that authorization,” Hudson Rock researchers said.

Changing a password may not be enough

According to Hudson Rock, Google password changes remain an essential recovery step, but victims of infostealer infections should also investigate other ways an attacker could retain access.

Security teams should take the following steps:

• Isolate the infected computer and complete remediation before using it for trusted account access again.
• Change compromised passwords from a separate, clean device.
• Review signed-in devices and revoke suspicious sessions and access to third-party applications.
• Check Gmail forwarding rules, filters, delegation settings, and remote mail access for unauthorized changes.
• Review account recovery methods and recent security activity.
• Secure other accounts that use the compromised mailbox for password resets or verification.