ToddyCat APT Deploys Umbrij Malware to Hijack Gmail via OAuth Token Theft

A new malware strain named Umbrij, attributed to the advanced persistent threat (APT) group ToddyCat, is abusing OAuth 2.0 tokens to gain unauthorized access to Gmail accounts via the Google API. The technique, dubbed Shadow Token via Remote Debug (STRD) by Kaspersky, exploits Chromium-based browsers by launching them in headless mode and connecting through a remote debugging port to seize an active Gmail session.

According to Kaspersky’s report, Umbrij performs a series of preparatory actions on a compromised Windows host. It verifies port availability for browser debugging, retrieves the user context by duplicating the token of the explorer.exe process, and constructs the path to the browser’s application folder. The malware then enumerates all browser profiles, scanning for email addresses that indicate an authenticated Google session. It copies critical profile files—including IndexedDB, Local Storage, Network, Login Data, and Preferences—into a BackupFiles directory, using a force-copy mechanism if files are locked.

Umbrij launches the browser in headless mode using the copied profile, applying active cookies to skip authentication. Using Puppeteer, it connects to the remote debugging port and sends an authorization code request to a Google OAuth URL, specifying a client_id for a migration tool used to import PST files into Google Workspace. The malware emulates mouse clicks to select the target account and grant permissions for full access to Gmail, Drive, Contacts, Calendar, and Tasks. The OAuth authorization code is then extracted and logged, later exchanged for an access token that allows the threat actors to compromise corporate email communications via the API.

Three versions of Umbrij have been identified, including those with helper functions for debugging and account selection. The malware is delivered via DLL side-loading, abusing legitimate binaries such as BDSubWiz.exe (Bitdefender ConnectAgent), VSTestVideoRecorder.exe (Microsoft Visual Studio), and GoogleDesktop.exe (discontinued Google Desktop Search). The rogue DLL is written in .NET and obfuscated with ConfuserEx. To mitigate the threat, organizations are advised to review authorized applications in Google account settings and revoke access to any instances of ‘Google Workspace Migration for Microsoft Outlook’ or ‘Google Workspace Sync for Microsoft Outlook’ that are not in use.