{"id":"CMP-202611-coo3f2","kind":"campaign","aliases":[],"related":[],"title":"Remus infostealer sells a Gmail mailbox-reading feature its makers say keeps working after a password change and session sign-out (Hudson Rock, Malwarebytes; claim not verified)","description":null,"summary":"Sellers of the Remus Stealer malware-as-a-service advertise in version 1.3.9 a 'Mail' feature that opens a victim's Gmail inbox from the operator dashboard, reads verification codes without stealing cookie files, and can be shared with other operators by link. They claim it survives a Google password change and session revocation, and the developer says it works through browser memory. Hudson Rock looked at the ads and spoke to the developer and a self-described customer, who said access kept working after a password change. Neither Hudson Rock nor Malwarebytes reverse-engineered the feature or tested it, so the persistence claim is unverified and there is no proof of a Gmail flaw. Who is infected and since when: unknown.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Gmail","fixed":[],"vendor":"Google"},{"name":"Google Workspace","fixed":[],"vendor":"Google"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Look for infostealer infection on Windows devices used to sign in to Gmail/Google Workspace (no Remus file hashes or domains published). In the Google account, check Security > Recent security events and Your devices for unknown sign-ins, third-party apps with Gmail access, and Gmail settings for unknown forwarding addresses, filters, delegated access and IMAP/POP changes, plus changed recovery email or phone. Unexpected verification-code or password-reset emails from other services are a warning sign.","fix":"If a device may be infected: disconnect it and clean or reinstall it before signing in on it again. From a separate clean device, change the Google password, sign out all sessions and devices, remove unknown apps, forwarding, filters and delegates, and check recovery options and 2-step settings. Do not treat a password change alone as recovery. Workspace admins can reset the user's sign-in cookies and revoke OAuth tokens from the Admin console. Then secure other accounts that use this mailbox for sign-in or recovery.","status":"open","published_at":null,"first_seen_at":"2026-11-11T14:00:46+00:00","triaged_at":"2026-11-11T14:00:46+00:00","updated_at":"2026-11-11T14:02:37+00:00","category":"other","confidence":null,"triage":{"cause":{"at":"2026-11-11T14:05:17Z","path":"unknown","entry":"unknown","reason":"The record says the victim population and infection timing are unknown and does not describe how any attacker got into an organisation or how devices were infected, only that the Remus Stealer's Gmail feature is advertised and its persistence claim is unverified.","confidence":0.6}},"analyst_status":"done","analyst_note":null,"search":"'-202611':31A '1.3.9':53B 'access':123B 'ad':109B 'advertis':50B 'browser':102B 'campaign':36B 'chang':18A,91B,129B 'claim':27A,85B,146B 'cmp':30A 'code':70B 'coo3f2':32A 'cooki':73B 'custom':120B 'dashboard':67B 'describ':119B 'develop':97B,114B 'earli':38B 'early-warn':37B 'engin':137B 'featur':9A,56B,139B 'file':74B 'flaw':157B 'gmail':5A,33A,62B,156B 'googl':89B 'google':34A 'hudson':24A,104B,131B 'inbox':63B 'infect':160B 'infosteal':2A 'keep':13A 'kept':124B 'link':83B 'look':106B 'mail':55B 'mailbox':7A 'mailbox-read':6A 'maker':11A 'malwar':46B 'malware-as-a-servic':45B 'malwarebyt':26A,134B 'memori':103B 'neither':130B 'open':58B 'oper':66B,81B 'password':17A,90B,128B 'persist':145B 'proof':153B 'read':8A,68B 'remus':1A,43B 'revers':136B 'reverse-engin':135B 'revoc':94B 'rock':25A,105B,132B 'said':122B 'say':12A,98B 'self':118B 'self-describ':117B 'sell':3A 'seller':40B 'servic':49B 'session':20A,93B 'share':78B 'sign':22A 'sign-out':21A 'sinc':162B 'spoke':111B 'steal':72B 'stealer':44B 'surviv':87B 'test':141B 'unknown':164B 'unverifi':148B 'verif':69B 'verifi':29A 'version':52B 'victim':60B 'warn':39B 'without':71B 'work':14A,100B,125B 'workspace':35A","nicknames":["Remus","Remus Stealer"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["gmail","googleworkspace","remus","remusstealer","workspace"],"ptokens":["gmail","google","workspace"],"labels":["campaign","earlywarning","medium","other"],"campaign_type":"malware","search_a":"'-202611':31A 'chang':18A 'claim':27A 'cmp':30A 'coo3f2':32A 'featur':9A 'gmail':5A,33A 'google':34A 'hudson':24A 'infosteal':2A 'keep':13A 'mailbox':7A 'mailbox-read':6A 'maker':11A 'malwarebyt':26A 'password':17A 'read':8A 'remus':1A 'rock':25A 'say':12A 'sell':3A 'session':20A 'sign':22A 'sign-out':21A 'verifi':29A 'work':14A 'workspace':35A","search_b":"'1.3.9':53B 'access':123B 'ad':109B 'advertis':50B 'browser':102B 'campaign':36B 'chang':91B,129B 'claim':85B,146B 'code':70B 'cooki':73B 'custom':120B 'dashboard':67B 'describ':119B 'develop':97B,114B 'earli':38B 'early-warn':37B 'engin':137B 'featur':56B,139B 'file':74B 'flaw':157B 'gmail':62B,156B 'googl':89B 'hudson':104B,131B 'inbox':63B 'infect':160B 'kept':124B 'link':83B 'look':106B 'mail':55B 'malwar':46B 'malware-as-a-servic':45B 'malwarebyt':134B 'memori':103B 'neither':130B 'open':58B 'oper':66B,81B 'password':90B,128B 'persist':145B 'proof':153B 'read':68B 'remus':43B 'revers':136B 'reverse-engin':135B 'revoc':94B 'rock':105B,132B 'said':122B 'say':98B 'self':118B 'self-describ':117B 'seller':40B 'servic':49B 'session':93B 'share':78B 'sinc':162B 'spoke':111B 'steal':72B 'stealer':44B 'surviv':87B 'test':141B 'unknown':164B 'unverifi':148B 'verif':69B 'version':52B 'victim':60B 'warn':39B 'without':71B 'work':100B,125B","search_c":"","cause_entry":"unknown","cause_path":"unknown","disclosures_checked_at":null,"first_public_at":"2026-11-11T13:42:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-coo3f2","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-11T14:00:46+00:00","fetched_at":"2026-11-11T14:00:46+00:00","note":null}],"documents":[{"id":125929,"url":"https://www.malwarebytes.com/blog/news/2026/11/remus-malware-claims-gmail-access-even-after-you-change-your-password","title":"Malwarebytes Labs: Remus malware claims Gmail access even after you change your password","kind":"blog","source":"blog","publisher":null,"text":"Remus malware claims Gmail access even after you change your password\n\nDevelopers of the infostealer Remus claim their malware can retain access to a victim’s Gmail even after a password reset.","published_at":"2026-11-11T13:42:10+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}