[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJxJGD6oYSwbTUnh9wxvsgZLjIkBFwtqQMiFlX-2kMWQ":3},{"article":4,"iocs":49,"watch_terms":81,"solutions":82,"lesson":177},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"b921db7d-50f2-41de-ab98-3215e68901bd","ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API","toddycat-linked-umbrij-malware-abuses-oauth-to-access-gmail-via-google-api-d29945","The threat actor known as ToddyCat has been attributed to a new malware called Umbrij that's designed to gain surreptitious access to a victim's email correspondence via the Google API. \"In this campaign, the attackers focused their attention on corporate email communications hosted on Gmail, targeting access compromise via APIs,\" Kaspersky said in a detailed report published this week. \"","The ToddyCat advanced persistent threat (APT) group is using new malware called Umbrij to steal corporate Gmail communications. Umbrij abuses the OAuth 2.0 protocol and Google API by exploiting active Gmail sessions in Chromium-based browsers through remote debugging ports to obtain access tokens. Kaspersky researchers discovered Umbrij during a threat hunting operation, noting its use of DLL side-loading and obfuscation techniques.","ToddyCat APT uses Umbrij malware to steal Gmail data via Google API and OAuth.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Ftoddycat-linked-umbrij-malware-abuses.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhMMnC-1ujLiZRcV1xgXbB3qFoIREcbSiGqLCFID8-G-z8GFI3YEY8VniprVEBW4b4TZKJUvoRDg27elntNJWL9S6JZUHMMe1Ie1JLf9w5Fzsgx2w9c94ja1NoED4m3G1pNngC2DDWOOQPgVGiKOd0uBpZkQSSpFOo60S2Tbl8j2VWKdhb70sIJzF8d93LM\u002Fs1600\u002Fgmail.jpg","2026-07-02T13:04:13+00:00","2026-07-02T14:00:07.702242+00:00",8,[17,20,23,26,29],{"name":18,"type":19},"ToddyCat","threat_actor",{"name":21,"type":22},"Kaspersky","vendor",{"name":24,"type":25},"Gmail","product",{"name":27,"type":28},"Google API","technology",{"name":30,"type":28},"OAuth 2.0","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,44],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,53,56,60,63,66,69,72,75,78],{"type":35,"value":51,"context":52},"Umbrij","Malware used by ToddyCat APT to steal Gmail data.",{"type":35,"value":54,"context":55},"TCSectorCopy","Custom tool previously used by ToddyCat APT to steal Microsoft Outlook data.",{"type":57,"value":58,"context":59},"mitre_attack","T1059.001","PowerShell usage for initial execution or reconnaissance.",{"type":57,"value":61,"context":62},"T1574.002","DLL Side-Loading via legitimate binaries.",{"type":57,"value":64,"context":65},"T1055.012","Process Injection: Process Hollowing.",{"type":57,"value":67,"context":68},"T1071.001","Web Protocols: HTTP\u002FHTTPS for C2 communication.",{"type":57,"value":70,"context":71},"T1041","Exfiltration Over C2 Channel.",{"type":57,"value":73,"context":74},"T1105","Ingress Tool Transfer.",{"type":57,"value":76,"context":77},"T1053.005","Scheduled Task\u002FJob: Scheduled Task.",{"type":57,"value":79,"context":80},"T1047","Windows Management Instrumentation.",[21,24],{"controls":83,"vendors":170},[84,112,141],{"slug":85,"name":86,"problem":87,"products":88},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[89,97,104],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":85,"product_name":101,"url":102,"description":103},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":113,"name":114,"problem":115,"products":116},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":142,"name":143,"problem":144,"products":145},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[146,154,162],{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":155,"vendor_name":156,"vendor_logo":157,"product_slug":158,"product_name":159,"url":160,"description":161},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":163,"vendor_name":164,"vendor_logo":165,"product_slug":166,"product_name":167,"url":168,"description":169},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[171],{"slug":172,"name":173,"logo_path":174,"roles":175},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[176],"affected",{"slug":178,"title":179,"body":180,"framework_refs":181,"framework_notes":196},"umbrij-malware-hijacks-oauth-tokens-via-browser-debug-ports-to-steal-gmail-data","Umbrij Malware Hijacks OAuth Tokens via Browser Debug Ports to Steal Gmail Data","The ToddyCat APT group's Umbrij malware exploits a dangerous combination of OAuth 2.0 token theft and Chromium's remote debugging ports to silently access corporate Gmail accounts without needing credentials. By harvesting active session tokens from the browser, attackers bypass multi-factor authentication entirely, since the token already represents an authenticated session. DLL side-loading and obfuscation allow the malware to persist and evade detection while exfiltrating sensitive email communications. This attack highlights that even well-designed authentication protocols like OAuth 2.0 can be weaponized when endpoint security and browser configurations are not properly hardened. Organizations relying on cloud productivity suites must treat browser session integrity as a critical security boundary.",[182,183,184,185,186,187,188,189,190,191,192,193,194,195],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AU-12: Audit Record Generation","NIST SP 800-63B: Digital Identity Guidelines (Session Management)","MITRE ATT&CK T1185: Browser Session Hijacking","MITRE ATT&CK T1550.001: Use Alternate Authentication Material – Application Access Token","MITRE ATT&CK T1574.002: DLL Side-Loading","GDPR Article 32: Security of Processing (for organizations handling EU personal data via Gmail)","ISO\u002FIEC 27001 A.9.4: System and Application Access Control",{}]