---
id: "CMP-202611-coo3f2"
page: "https://infrastack.ai/live/CMP-202611-coo3f2"
kind: "campaign"
aliases: []
title: "Remus infostealer sells a Gmail mailbox-reading feature its makers say keeps working after a password change and session sign-out (Hudson Rock, Malwarebytes; claim not verified)"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Gmail", "fixed": [], "vendor": "Google"}, {"name": "Google Workspace", "fixed": [], "vendor": "Google"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-11T14:00:46+00:00"
updated_at: "2026-11-11T14:02:37+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-11T14:00:46+00:00"}]
exploit_sources: []
---

# Remus infostealer sells a Gmail mailbox-reading feature its makers say keeps working after a password change and session sign-out (Hudson Rock, Malwarebytes; claim not verified)

Link for people: https://infrastack.ai/live/CMP-202611-coo3f2 (this .md is for agents)

Sellers of the Remus Stealer malware-as-a-service advertise in version 1.3.9 a 'Mail' feature that opens a victim's Gmail inbox from the operator dashboard, reads verification codes without stealing cookie files, and can be shared with other operators by link. They claim it survives a Google password change and session revocation, and the developer says it works through browser memory. Hudson Rock looked at the ads and spoke to the developer and a self-described customer, who said access kept working after a password change. Neither Hudson Rock nor Malwarebytes reverse-engineered the feature or tested it, so the persistence claim is unverified and there is no proof of a Gmail flaw. Who is infected and since when: unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Gmail affected range not listed fixed no fixed version listed
- :Google Workspace affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: not disclosed yet (unknown). The record says the victim population and infection timing are unknown and does not describe how any attacker got into an organisation or how devices were infected, only that the Remus Stealer's Gmail feature is advertised and its persistence claim is unverified.

How it reached others: not stated (unknown).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#unknown

## How to check

Look for infostealer infection on Windows devices used to sign in to Gmail/Google Workspace (no Remus file hashes or domains published). In the Google account, check Security > Recent security events and Your devices for unknown sign-ins, third-party apps with Gmail access, and Gmail settings for unknown forwarding addresses, filters, delegated access and IMAP/POP changes, plus changed recovery email or phone. Unexpected verification-code or password-reset emails from other services are a warning sign.

## Fix

If a device may be infected: disconnect it and clean or reinstall it before signing in on it again. From a separate clean device, change the Google password, sign out all sessions and devices, remove unknown apps, forwarding, filters and delegates, and check recovery options and 2-step settings. Do not treat a password change alone as recovery. Workspace admins can reset the user's sign-in cookies and revoke OAuth tokens from the Admin console. Then secure other accounts that use this mailbox for sign-in or recovery.

## Timeline

- 2026-11-11T14:00:46+00:00 analyst

## Documents

- [describes] Malwarebytes Labs: Remus malware claims Gmail access even after you change your password https://www.malwarebytes.com/blog/news/2026/11/remus-malware-claims-gmail-access-even-after-you-change-your-password

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_