[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3MfW9AZCem7cBDRS81qfx2zhPMB1sahPKvNr8j-UyvM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"45c57067-2922-4367-ada8-cd1517470166","infostealer-claims-to-maintain-gmail-access-beyond-password-resets","6167a1e9-2012-49c6-9a3c-f14cf2e34b15","Infostealer Claims to Maintain Gmail Access Beyond Password Resets","A commercial infostealer tool, Remus Stealer, is being marketed with a feature that allegedly maintains persistent access to Gmail accounts even after victims change their passwords or revoke sessions — suggesting exploitation of OAuth tokens or browser-stored credentials rather than passwords themselves. This matters because users and organisations commonly treat a password reset as a full account recovery step, not realising that stolen authentication tokens can persist independently of credentials. If the capability is genuine, it means traditional incident response playbooks focused on password rotation are insufficient on their own. Organisations must understand that credential theft has evolved beyond passwords to target the session and token layer of authentication.","**Immediate actions:**\n- Audit and revoke all active OAuth tokens and third-party app authorisations for sensitive accounts after any suspected compromise, not just reset the password.\n- Enable Google's Advanced Protection Program or equivalent MFA enforcement for all high-value accounts to limit token issuance scope.\n\n**Long-term improvements:**\n- Implement endpoint detection capable of identifying infostealer behaviour such as browser memory scraping and credential file access.\n- Adopt a Zero Trust posture that enforces continuous re-authentication and device posture checks, reducing the value of stolen long-lived tokens.\n- Train users and incident responders that password resets alone do not terminate stolen OAuth or session tokens.\n\n**Detection measures:**\n- Monitor for anomalous Gmail login events from unfamiliar IPs or devices via Google Workspace audit logs and alert on session continuity after a password change.\n- Deploy endpoint protection that detects and blocks access to browser credential stores and memory regions used by infostealers.",[12,13,14,15,16],"MITRE ATT&CK T1539: Steal Web Session Cookie","NIST SP 800-53 IA-11: Re-Authentication","NIST CSF 2.0 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate least privilege and separation of duties","NIS2 Article 21(2)(j)","CIS Control 16: Application Software Security",{"NIS2 Article 21(2)(j)":18,"NIST SP 800-53 IA-11: Re-Authentication":19,"MITRE ATT&CK T1539: Steal Web Session Cookie":20,"CIS Control 16: Application Software Security":21,"NIST CSF 2.0 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate least privilege and separation of duties":22},"This point mandates multi-factor authentication and secured communications controls, which reduce reliance on single-factor session tokens and make stolen tokens harder to leverage without an additional verified factor.","This control requires systems to enforce re-authentication after defined conditions, which would limit the useful lifetime of stolen session tokens and reduce the window of unauthorised access after a compromise.","This technique covers adversary theft of browser session cookies or tokens to maintain authenticated access without needing credentials, which is precisely the persistent access mechanism Remus Stealer allegedly exploits.","This control addresses secure management of authentication and session handling in applications, including ensuring that session invalidation is comprehensive and effective after a credential reset event.","Regularly reviewing and revoking unnecessary OAuth authorisations and session grants would have limited the persistent access a stolen token could provide to a victim's Gmail inbox.","published","2026-11-11T12:22:39.743124+00:00","2026-11-11T12:22:39.713+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fsecurityaffairs.com\u002F202853\u002Fmalware\u002Fhackers-advertise-a-1000-gmail-tool-that-allegedly-survives-password-resets.html","hackers-advertise-a-1-000-gmail-tool-that-allegedly-survives-password-resets-69e060","Hackers Advertise a $1,000 Gmail Tool That Allegedly Survives Password Resets",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[45,49,53],{"slug":46,"name":47,"problem":48},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":50,"name":51,"problem":52},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":54,"name":55,"problem":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]