A security firm says a $1,000-a-month tool can keep reading Gmail after a password reset. Most people face low risk, but the claim is worth knowing.
A security firm says a hacking tool can keep reading a Gmail inbox even after the owner changes the password and signs out other devices. The tool is called Remus Stealer and reportedly rents for $1,000 a month. The claims are not proven. Tom's Guide has asked Google for comment and has not yet had a response.
Email is the key to many other accounts. If the claims are true, attackers could grab password reset links and verification codes. Hudson Rock says it spoke with the developer and a customer, who shared screenshots of messages, timestamps and controls for sharing a hacked mailbox with other operators.
How it survives a reset is unclear. The developer gave no technical details, only saying the tool interacts with browser memory. Hudson Rock's leading guess is that it grabs reusable permission from a signed-in browser. A remote part could then keep requesting mail after the program on the computer closes.
The tool is advertised to enterprise buyers, so businesses and high-profile people are the likelier targets. The mailbox must also be compromised first. Most people face lower risk. The best defense is avoiding phishing and malware, which the alert box above covers. Watch for Google's response and any new Gmail protections.
Most people are at low risk, but stay alert to phishing and malware, since a stolen inbox can unlock your other accounts.
Deputies in the Upstate area say scammers are calling while posing as police officers, and a scary call can cost you money or personal details.
Read more: Sheriff's deputies warn of scam calls from fake police officersNew York's attorney general released a guide to help veterans and service members spot pension scams, shady VA benefits offers and phishing before money is lost.
Read more: New York warns veterans and service members about scamsCallers claiming to be U.S. Marshals say you missed a grand jury subpoena and face arrest. The sheriff's office says it is a scam and wants you to hang up.
Read more: Fake federal warrant calls are targeting Kentucky residents
