ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API
ToddyCat APT uses Umbrij malware to steal Gmail data via Google API and OAuth.
The ToddyCat advanced persistent threat (APT) group is using new malware called Umbrij to steal corporate Gmail communications. Umbrij abuses the OAuth 2.0 protocol and Google API by exploiting active Gmail sessions in Chromium-based browsers through remote debugging ports to obtain access tokens. Kaspersky researchers discovered Umbrij during a threat hunting operation, noting its use of DLL side-loading and obfuscation techniques.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Kaspersky?
Get an email when a new story names Kaspersky, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe ToddyCat APT group's Umbrij malware exploits a dangerous combination of OAuth 2.0 token theft and Chromium's remote debugging ports to silently access corporate Gmail accounts without needing credentials. By harvesting active session tokens from the browser, attackers bypass multi-factor authentication entirely, since the token already represents an authenticated session. DLL side-loading and obfuscation allow the malware to persist and evade detection while exfiltrating sensitive email communications. This attack highlights that even well-designed authentication protocols like OAuth 2.0 can be weaponized when endpoint security and browser configurations are not properly hardened. Organizations relying on cloud productivity suites must treat browser session integrity as a critical security boundary.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Umbrij
- malware — TCSectorCopy
- mitre_attack — T1059.001
- mitre_attack — T1574.002
- mitre_attack — T1055.012
- mitre_attack — T1071.001
- mitre_attack — T1041
- mitre_attack — T1105
- mitre_attack — T1053.005
- mitre_attack — T1047