ToddyCat's Umbrij Malware Quietly Hijacks Gmail via OAuth Abuse
The ToddyCat APT group has a new tool in its kit, and this one goes after corporate Gmail accounts by abusing Google's own authorisation infrastructure. Kaspersky researchers discovered the malware, dubbed Umbrij, during a threat hunting operation and have since published a detailed breakdown of how it works.
The core trick is straightforward, if technically slick. Because Google's API uses OAuth 2.0 for authorisation, any application holding a valid OAuth token can access email resources without touching a password. Umbrij exists to steal that token. Kaspersky has named the technique Shadow Token via Remote Debug, or STRD.
The attack chain starts with a scheduled task impersonating Kaspersky's own endpoint security software. That task launches a legitimately signed binary, which then uses DLL side-loading to bring Umbrij into memory. Three different binaries have been observed taking this role: BDSubWiz.exe from Bitdefender's ConnectAgent, VSTestVideoRecorder.exe from Microsoft Visual Studio's testing toolkit, and GoogleDesktop.exe, a long-discontinued Google file indexing app. All three are legitimate signed executables susceptible to side-loading, which helps the malware blend in.
Umbrij itself is a .NET DLL obfuscated with ConfuserEx. Once running, it carries out a fairly methodical sequence of operations on the compromised host. It checks for an available debugging port, then locates an explorer.exe process and duplicates its token to inherit the logged-in user's privileges. From there it reads the browser's Local State file to identify stored Chrome or Edge user profiles, scanning each one for email addresses that indicate an active Google session.
Matching profiles get their relevant files copied into a BackupFiles directory. The tool then launches the browser in headless mode using those copied profiles, which crucially means it inherits all active cookies including any signed-in Google accounts, bypassing authentication entirely.
This is where Puppeteer comes in. Umbrij uses the JavaScript library to connect to the browser's remote debugging port via the Chrome DevTools Protocol and directs the session to Google's OAuth endpoint. The client ID it presents belongs to Google Workspace Migration for Microsoft Outlook, a legitimate tool for importing PST files and Exchange data into Google Workspace. By impersonating that tool, Umbrij requests broad permissions including full access to Gmail, Drive, Contacts, Calendar, and Tasks. JavaScript is used to simulate mouse clicks, selecting the target account and granting consent without any user interaction.
The resulting OAuth authorisation code is written to a log file and later exfiltrated. That code is then exchanged for an access token, giving the attackers persistent API-level access to the victim's Gmail account.
Three versions of Umbrij have been identified, with some variants including helper functions for debugging and account selection within the browser.
ToddyCat has been active since at least 2020, targeting organisations across Europe and Asia. Last November, Kaspersky flagged the group's use of a separate tool called TCSectorCopy, which went after Microsoft Outlook data. The shift to Gmail suggests the group is methodically working through enterprise email platforms.
Defending against this particular attack is relatively simple once you know to look. Anyone concerned should check myaccount.google.com/connections for authorised applications. If Google Workspace Migration for Microsoft Outlook or Google Workspace Sync for Microsoft Outlook appears there and your organisation has no legitimate reason for it, revoke access immediately. That invalidates any OAuth tokens already in the wild.
The broader takeaway is that OAuth abuse is an increasingly attractive vector precisely because it sidesteps credentials entirely. You can have perfect password hygiene and still get compromised if someone can quietly grab a valid session token from an already-authenticated browser.