{"id":1579,"date":"2026-07-02T13:37:48","date_gmt":"2026-07-02T13:37:48","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1579"},"modified":"2026-07-02T13:37:48","modified_gmt":"2026-07-02T13:37:48","slug":"toddycat-linked-umbrij-malware-abuses-oauth-to-access-gmail-via-google-api","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1579","title":{"rendered":"ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Jul 02, 2026<\/span><\/span>API Security \/ Cyberespionage<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The threat actor known as ToddyCat<\/b> has been attributed to a new malware called Umbrij that’s designed to gain surreptitious access to a victim’s email correspondence via the Google API.<\/p>\n

\u00abIn this campaign, the attackers focused their attention on corporate email communications hosted on Gmail, targeting access compromise via APIs,\u00bb Kaspersky said<\/a> in a detailed report published this week. \u00abBecause the Google API relies on the OAuth 2.0 protocol for authorization, applications can use an OAuth token to access requested email resources.\u00bb<\/p>\n

The adversary is said to have developed Umbrij to acquire this token and use it to connect to the browser’s management console in headless mode<\/a> via a remote debugging port.<\/p>\n

Subsequently, a series of requests was issued to obtain an OAuth authorization code, which was then exchanged for an access token to reach the target resources via the API. The technique has been codenamed Shadow Token via Remote Debug<\/b> (STRD) by the Russian cybersecurity vendor.<\/p>\n

What’s notable about the attack is that it’s viable on Chromium-based browsers and exploits an active Gmail session. In other words, the idea is to launch the browser in headless mode<\/a>, connect via the remote debugging port to seize control, and leverage an already logged-in Gmail session to obtain access to the Google account resources.<\/p>\n

Three different versions of Umbrij have been uncovered, including versions that feature helper functions for debugging and for searching and selecting user accounts within the browser.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

ToddyCat is the name assigned<\/a> to an advanced persistent threat (APT) that has a history of targeting various organizations in Europe and Asia since at least 2020. In November 2025, Kaspersky detailed the hacking group’s use of a custom tool dubbed TCSectorCopy to lay their hands on Microsoft Outlook email data belonging to targeted companies.<\/p>\n

<\/p>\n

The cybersecurity company said it discovered Umbrij during what it described as a \u00abthreat hunting operation,\u00bb as part of which a scheduled task impersonating its software (\u00abKasperskyEndpointSecurityEDRAvp\u00bb) was used to launch a digitally signed file. The signed file then employed DLL side-loading<\/a> to launch Umbrij.<\/p>\n

To accomplish this task, three legitimate binaries susceptible to DLL side-loading were abused –<\/p>\n