Industry Pulse News Desk · Edited by Yaroslav Kryzhanivsky · · 59m ago
Subscription Malware Tool Targets Gmail Accounts via Stolen Session Cookies
Google says its email service remains secure after reports surfaced of a paid malware tool offering persistent access to compromised accounts.
A commercial malware service priced at $1,000 per month is advertising capabilities to maintain continuous access to compromised Google Gmail accounts, according to cybersecurity researchers. Google confirmed it is aware of the threat activity but stated the issue stems from compromised local devices rather than any flaw within its email infrastructure.
The malicious software reportedly bypasses traditional authentication controls, including multi-factor authentication and password resets, by stealing persistent session cookies from infected web browsers. Once deployed on a target computer, the tool allows attackers to extract data and maintain access even if the account holder updates their login credentials.
Security engineers at Google clarified that the email platform itself has not been breached. The company emphasized that session hijacking relies on malware already executing on a victim's endpoint, which extracts active session tokens directly from local browser storage.
Google noted it regularly updates detection mechanisms and session management protocols to invalidate stolen tokens and reduce operational risks. Cybersecurity teams recommend that enterprise users enforce endpoint protection controls, limit unauthorized software installations, and revoke active sessions if a local compromise is suspected.
The emergence of subscription-based session-stealing software highlights a growing trend in the cybercrime ecosystem toward high-cost specialized tools. Security professionals advise organizations to prioritize endpoint monitoring to stop malware before session tokens can be exfiltrated.