Google’s “zero-day”: Attackers say they have access to Gmail even after password change

Reports circulating in underground forums claim that a new offering tied to the Remus infostealer could let attackers keep reading a victim's Gmail inbox even after the owner changes their password. The seller reportedly wants $1,000 per month for the capability, and the claim has drawn attention from security researchers. Google has not confirmed a "zero-day" flaw, and the evidence so far comes mostly from the sellers' own advertising and from analysis of how similar stealers work. Here is what is known, what is only alleged, and what users should do.

The story matters because Gmail is often the master key to a person's digital life. Password resets for banking, social media, and workplace tools usually land in that inbox. If an attacker really can maintain silent access after a password change, the usual advice to "just change your password" would no longer be enough on its own.

What Attackers Are Actually Claiming Right Now

According to the reporting, the sellers say their tool gives persistent access to Gmail accounts that survives a password reset. They advertise it as a subscription service priced at roughly $1,000 a month. The pitch is aimed at cybercriminals who want long-term mailbox access rather than a one-time login.

These claims have not been independently verified in full. Underground sellers often exaggerate what their products can do to attract buyers, so the advertisement alone is not proof of a new Vulnerability. Still, the claim is specific enough that researchers are taking it seriously.

How the Remus Stealer Fits Into This

Remus is described as an infostealer, a type of malware that harvests data from infected computers. Such malware typically grabs saved passwords, browser cookies, autofill data, and authentication tokens. The stolen material is then packaged and sold or used directly by the operators.

Infostealers have become a leading source of account compromise in recent years. Because they collect session data rather than only passwords, they can give attackers a route into accounts that does not depend on knowing the current password at all.

Why Session Tokens Could Explain Persistent Access

The most plausible technical explanation is the theft of session cookies or tokens. When you log in to Gmail, the browser stores a token that proves you are already authenticated. If malware copies that token, an attacker can present it to Google and be treated as the logged-in user.

Normally, changing a password should invalidate many active sessions, but that does not always happen instantly or across every token type. If some tokens remain valid after a reset, or if attackers can refresh them, access might continue. That behavior would be a weakness in session handling rather than a classic bug that lets someone break in from nothing.

Is This Really a Google Zero-Day Vulnerability

The term "zero-day" refers to a flaw unknown to the vendor and Exploited before a patch exists. The attackers' framing suggests they have found such a gap in how Google handles authentication. However, there is no public confirmation From Google that a new vulnerability is being exploited.

It is also possible that the capability relies on known weaknesses in token lifetimes combined with malware on the victim's device. In that case, the issue would be better described as abuse of stolen credentials than as a true zero-day. The difference matters, because it affects how the problem can be fixed.

What the Available Evidence Does and Doesn't Show

So far, the evidence consists of forum posts, seller claims, and expert interpretation. Researchers have not published a complete technical demonstration proving that a password change fails to cut off access in every case. Without that, the story remains partly unverified.

That said, the general pattern is well documented. Security teams have repeatedly shown that stolen cookies can bypass passwords and even multi-factor authentication. The new claim fits an established trend, which gives it some credibility even though the specifics are unconfirmed.

Practical Steps Gmail Users Should Take Today

Users should not rely on a password change alone if they suspect compromise. After changing the password, go to your Google account security settings and sign out of all devices and sessions. Review the list of devices with access and remove anything unfamiliar.

It is also wise to check third-party app permissions, mail forwarding rules, and filters, since attackers often use these to keep reading messages. Enabling passkeys or hardware security keys offers stronger protection than passwords and codes alone. Finally, scan your computer for malware, because a reset is pointless if the infection that stole the data is still running.

Protecting Yourself From Infostealer Malware Infections

Because the root of the problem is often malware, prevention starts with safe habits. Avoid downloading cracked software, pirated games, and attachments from unknown senders, which are common infection routes. Keep your operating system, browser, and security software up to date.

Consider using a reputable password manager rather than saving credentials in the browser, and clear stored cookies periodically. If you ever think a device was infected, treat all accounts used on it as exposed and secure them from a clean device.

What Happens Next and What to Watch

The key development to watch is a response from Google. The company could confirm or dispute the claim, tighten how sessions are revoked after password changes, or add detection for stolen tokens. Independent researchers may also publish tests that settle whether persistence really works as advertised.

Until then, the sensible approach is caution without panic. The claim is serious if true, but it is unproven, and the best defenses remain the same: strong authentication, session review, and keeping malware off your devices. This blog will update the story as more verified details emerge.

If you have any questions, please don't hesitate to Contact Us