Hackers Advertise a $1,000 Gmail Tool That Allegedly Survives Password Resets

A commercial infostealer tool, Remus Stealer, is being marketed with a feature that allegedly maintains persistent access to Gmail accounts even after victims change their passwords or revoke sessions — suggesting exploitation of OAuth tokens or browser-stored credentials rather than passwords themselves. This matters because users and organisations commonly treat a password reset as a full account recovery step, not realising that stolen authentication tokens can persist independently of credentials. If the capability is genuine, it means traditional incident response playbooks focused on password rotation are insufficient on their own. Organisations must understand that credential theft has evolved beyond passwords to target the session and token layer of authentication.