Google’s Gmail users warned of new hacking threat

Coverage from Inc., DailyVoice.com, and HotHardware reports on a newly advertised hacking tool named Remus that its operators claim can maintain persistent access to Gmail inboxes. According to the Inc. article published on November 11, 2026, the tool is marketed at a subscription price of $1,000 per month and its sellers assert it survives standard security measures such as password resets. HotHardware's coverage echoes the claim that the tool can continue snooping on Gmail accounts after credentials are changed, while DailyVoice.com frames the development as a new hacking tool targeting Gmail inboxes and outlines what users should know.

The Inc. report emphasizes Google's response, stating that Google says Gmail itself is not the vulnerability, suggesting the compromise may stem from user-side factors such as malware installation, session hijacking, or credential theft rather than a flaw in Gmail's infrastructure. HotHardware focuses on the technical claim of persistence through password resets, a feature that would make the tool particularly dangerous if verified. DailyVoice.com takes a consumer-advisory angle, highlighting the tool's existence and offering guidance implications for users. Together, the three sources provide a multi-faceted view: the threat actor's marketing claims, the platform provider's rebuttal, and the practical impact on end users.

The context for this trend includes the ongoing arms race between account takeover techniques and platform defenses. Session cookie theft, browser-in-the-middle frameworks, and info-stealer malware have long enabled attackers to bypass multi-factor authentication and maintain access without needing persistent password validity. A tool advertised at $1,000 per month signals a professionalized, access-as-a-service model targeting high-value accounts. Google's insistence that Gmail is not the vulnerability aligns with standard platform messaging when compromises originate from client-side compromise or phishing rather than server-side breaches. The simultaneous publication across business, tech, and consumer-focused outlets reflects broad concern about email account security.

What to watch next includes any technical analysis from independent security researchers validating or debunking Remus's claimed persistence capabilities, Google's potential release of additional mitigations or user guidance, and whether law enforcement or platform abuse teams take action against the tool's distribution channels. Coverage does not yet specify the infection vector, the exact mechanism of persistence, or the scale of any active campaigns using Remus. Users should monitor official Google Workspace security advisories and apply standard hygiene: hardware security keys, passkeys, regular session reviews, and endpoint protection.