ToddyCat APT Uses Umbrij Malware to Steal Gmail OAuth Tokens From Corporate Accounts

Kaspersky's threat hunting team has documented a new tool deployed by the ToddyCat advanced persistent threat group, named Umbrij, which is designed to silently gain access to corporate Gmail accounts by abusing the OAuth 2.0 authorisation protocol and the Google API. The technique, which Kaspersky has named Shadow Token via Remote Debug (STRD), requires no phishing link, no stolen password, and no user interaction after the initial system compromise. Once Umbrij is running on a victim's machine, it operates entirely in the background and leaves no visible indication to the user that their corporate email has been accessed.

ToddyCat is an advanced persistent threat group that has been active since at least 2020, with a documented history of targeting organisations across Europe and Asia for corporate espionage purposes. In November 2025 Kaspersky documented the group's use of a separate tool called TCSectorCopy to steal Microsoft Outlook email data from targeted enterprises. Umbrij represents the same objective applied to Gmail and Google Workspace environments, which have become the dominant enterprise email platform across many industries globally, including across UAE and Saudi Arabia.

How Umbrij enters and operates

Umbrij is delivered through DLL sideloading, a technique in which a legitimate, digitally signed executable is used to load a malicious DLL as part of its normal startup routine. Kaspersky's investigation identified three signed binaries abused for this purpose: BDSubWiz.exe, a component of Bitdefender ConnectAgent; VSTestVideoRecorder.exe, a Microsoft Visual Studio testing component; and GoogleDesktop.exe, a discontinued Google Desktop Search application. In each case, the signed binary loads the rogue Umbrij DLL, which is written in .NET and obfuscated with ConfuserEx to evade static analysis.

Kaspersky's threat hunting team discovered Umbrij through a scheduled task that was impersonating Kaspersky's own software, using the name KasperskyEndpointSecurityEDRAvp to disguise itself as a legitimate security process.

The OAuth abuse technique

Once Umbrij is running on the compromised host, it follows a structured sequence to extract Gmail OAuth authorisation codes without triggering any visible authentication prompt.

The tool first identifies whether Chrome or Edge is installed and locates the user profile directories for each. It scans the stored profiles for accounts containing an email address in the user name field, which indicates that the user is already authenticated to a Google service in that browser. It then copies the target profile files, including cookies, login data, local storage, and session data, into a backup directory.

Using that copied profile, Umbrij launches Chrome or Edge in headless mode, which runs the browser as a background process with no visible window. Because the copied profile includes active authentication cookies from the user's real Gmail session, the headless browser applies those cookies and the session is automatically authenticated without requiring the user to log in again.

Umbrij then uses Puppeteer, a JavaScript library for controlling Chromium browsers via the Chrome DevTools Protocol, to connect to the headless browser's remote debugging port and navigate to a Google OAuth authorisation URL. The client ID specified in this request corresponds to a legitimate Google Workspace migration tool used for importing data from Microsoft Exchange or PST files into Google Workspace, specifically the Google Workspace Migration for Microsoft Outlook tool. By using this legitimate client ID, the authorisation request appears to Google as a normal application authorisation rather than a suspicious external request.

The headless browser, operating as the authenticated user, automatically grants the requested permissions and redirects to a local address specified in the original request. Umbrij extracts the authorisation code from that redirect URL and logs it to a file on disk. The attacker subsequently retrieves that log file from the compromised host and exchanges the authorisation code for an OAuth access token. That token provides full API access to the victim's Gmail account, including read access to all email, contacts, calendar, drive, and tasks.

Three versions of Umbrij have been identified with varying functionality, including versions with helper functions for debugging and for selecting specific user accounts within the browser. The tool can also save screenshots of user profiles as PDFs and accepts command-line parameters specifying which browser to target.

Why this matters for GCC enterprise security teams

Gmail and Google Workspace are deployed across a significant proportion of GCC enterprise and government technology organisations. The STRD technique that Umbrij uses does not require the attacker to know the user's password, bypass two-factor authentication at login, or trigger any authentication alert visible to the user or to security monitoring tools. The entire operation runs in the background as a headless browser process.

The specific risk for enterprise security teams is that conventional monitoring for credential theft looks for failed authentication attempts, password spray patterns, or suspicious login geography. The STRD technique bypasses all of these signals because it never attempts to log in. It inherits an already-authenticated session and uses a legitimate OAuth flow to extract a token that provides persistent API-level access.

Kaspersky recommends that organisations audit their Google account connections immediately by navigating to myaccount.google.com/connections and reviewing which applications have been granted access. If either "Google Workspace Migration for Microsoft Outlook" or "Google Workspace Sync for Microsoft Outlook" appears in the connections list and is not actively in use within the organisation, their access should be revoked immediately to invalidate any OAuth tokens that may have been extracted through this technique.

This attack follows directly from the OAuth abuse pattern documented in MCW's coverage of the Salesforce Klue OAuth breach and the Microsoft MCP tool poisoning advisory. In each case, legitimate OAuth flows designed for authorised application access are being weaponised to exfiltrate credentials and data without triggering conventional detection controls. The common defensive response across all three cases is the same: maintain a strict inventory of authorised OAuth application connections and revoke any connection that is not actively and intentionally in use.