Toddy Cat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API
Summary: Kaspersky attributed a new malware called Umbrij to the ToddyCat APT, which uses the Google API's OAuth 2.0 authorization flow to reach corporate Gmail accounts. Umbrij launches a Chromium-based browser in headless mode, connects through a remote debugging port to an already logged-in Gmail session, obtains an OAuth authorization code, and exchanges it for an access token; Kaspersky codenamed the technique Shadow Token via Remote Debug (STRD).
Why it matters: The attack needs no stolen password: an active Gmail session in Chrome or Edge is enough, and Kaspersky found three Umbrij versions, one launched by a scheduled task impersonating Kaspersky's own software. ToddyCat has targeted organizations in Europe and Asia since at least 2020, and Kaspersky advises checking myaccount.google.com/connections for OAuth grants to 'Google Workspace Migration for Microsoft Outlook' or 'Google Workspace Sync for Microsoft Outlook' and revoking any the organization does not use.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026