A Google "zero-day" vulnerability? Hackers claim they can access Gmail even after a password change
Original headlineUne faille « Zero-day» de Google ? Des pirates affirment pouvoir accéder à Gmail même après un changement de mot de passe
Not investment advice. Muhabbit scores how much a story may matter, not which way to trade.
The developers behind the Remus Stealer malware claim to have discovered a zero-day flaw in Google's Gmail that lets attackers retain access to inboxes even after a password change. The group says stolen session tokens or cookies remain valid post-reset, undermining the common security advice to change credentials after a breach. Google has not yet confirmed the issue, and the claim is being treated as unverified by cybersecurity observers. If confirmed, the flaw would affect Gmail's roughly 1.8 billion users and could push Google to shorten session lifetimes or force re-authentication across devices. What to watch next is whether Google acknowledges the bug and whether rival password managers and email providers face similar token-replay exposure.
Muhabbit's AI wrote this summary in its own words from Cryptoast's report and translated it from French. It can get details wrong, so check the source.
Named in this story
Gmail, Google (GOOGL), Remus Stealer
A linked name opens that asset's sentiment page.