[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKcX5iKKfXk5F6K4Tqca-6bH4lfp-9q_y-h4DQKQ7uT0":3},{"article":4,"iocs":41,"watch_terms":45,"solutions":46,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"6167a1e9-2012-49c6-9a3c-f14cf2e34b15","Hackers Advertise a $1,000 Gmail Tool That Allegedly Survives Password Resets","hackers-advertise-a-1-000-gmail-tool-that-allegedly-survives-password-resets-69e060","Hackers advertise a $1,000-a-month tool claiming persistent Gmail access after password resets, but its effectiveness remains unverified. A developer of hacking tools is selling a $1,000 per month feature that allegedly gives criminals continuous access to Gmail inboxes. The cybersecurity firm Hudson Rock reports that the tool can keep reading a victim’s mailbox after a […]","A developer of hacking tools is selling a $1,000 per month feature for Remus Stealer, an infostealer, that allegedly provides continuous access to Gmail inboxes even after password changes or session revocations. While the developer claims it bypasses Google's anti-fraud checks and interacts with browser memory, its effectiveness and the underlying mechanism remain unverified by cybersecurity firms like Hudson Rock and CyberInsider.","Hackers advertise a $1,000\u002Fmonth tool claiming persistent Gmail access after password resets.","https:\u002F\u002Fsecurityaffairs.com\u002F202853\u002Fmalware\u002Fhackers-advertise-a-1000-gmail-tool-that-allegedly-survives-password-resets.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fimage-21.png","2026-11-11T10:42:36+00:00","2026-11-11T12:00:40.581378+00:00",7,[17,20],{"name":18,"type":19},"Google","vendor",{"name":21,"type":22},"Gmail","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42],{"type":27,"value":43,"context":44},"Remus Stealer","Infostealer malware advertised with a feature for persistent Gmail access.",[18],{"controls":47,"vendors":129},[48,77,103],{"slug":49,"name":50,"problem":51,"products":52},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":78,"name":79,"problem":80,"products":81},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[82,87,95],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":83,"product_name":84,"url":85,"description":86},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":104,"name":105,"problem":106,"products":107},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[108,116,121],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":117,"product_name":118,"url":119,"description":120},"managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",[130],{"slug":131,"name":18,"logo_path":132,"roles":133},"google","\u002Fvendor-logos\u002Fgoogle.png",[134],"affected",{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":145},"infostealer-claims-to-maintain-gmail-access-beyond-password-resets","Infostealer Claims to Maintain Gmail Access Beyond Password Resets","A commercial infostealer tool, Remus Stealer, is being marketed with a feature that allegedly maintains persistent access to Gmail accounts even after victims change their passwords or revoke sessions — suggesting exploitation of OAuth tokens or browser-stored credentials rather than passwords themselves. This matters because users and organisations commonly treat a password reset as a full account recovery step, not realising that stolen authentication tokens can persist independently of credentials. If the capability is genuine, it means traditional incident response playbooks focused on password rotation are insufficient on their own. Organisations must understand that credential theft has evolved beyond passwords to target the session and token layer of authentication.",[140,141,142,143,144],"MITRE ATT&CK T1539: Steal Web Session Cookie","NIST SP 800-53 IA-11: Re-Authentication","NIST CSF 2.0 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate least privilege and separation of duties","NIS2 Article 21(2)(j)","CIS Control 16: Application Software Security",{"NIS2 Article 21(2)(j)":146,"NIST SP 800-53 IA-11: Re-Authentication":147,"MITRE ATT&CK T1539: Steal Web Session Cookie":148,"CIS Control 16: Application Software Security":149,"NIST CSF 2.0 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate least privilege and separation of duties":150},"This point mandates multi-factor authentication and secured communications controls, which reduce reliance on single-factor session tokens and make stolen tokens harder to leverage without an additional verified factor.","This control requires systems to enforce re-authentication after defined conditions, which would limit the useful lifetime of stolen session tokens and reduce the window of unauthorised access after a compromise.","This technique covers adversary theft of browser session cookies or tokens to maintain authenticated access without needing credentials, which is precisely the persistent access mechanism Remus Stealer allegedly exploits.","This control addresses secure management of authentication and session handling in applications, including ensuring that session invalidation is comprehensive and effective after a credential reset event.","Regularly reviewing and revoking unnecessary OAuth authorisations and session grants would have limited the persistent access a stolen token could provide to a victim's Gmail inbox."]