vulnerability
ToddyCat's Umbrij Malware Rides Live Gmail Sessions
2026-07-03
The APT group ToddyCat has picked up a new tool, and it is a neat piece of work. Kaspersky researchers have named it Umbrij, and its sole job is to sit quietly on an infected machine and read whoever's corporate Gmail happens to be signed in.
What makes it interesting is that Umbrij doesn't bother with the login screen at all. No phishing kit, no credential stuffing, no password cracker. It waits for a user who is already authenticated to Gmail, then relaunches a Chromium browser (Chrome or Edge will do) in headless mode and attaches to it through the remote debugging port. Once it's inside a browser Google already trusts, it walks the OAuth 2.0 authorisation flow as if it were the user, collects an authorisation code, swaps that for an access token, and starts pulling mail via the Google API.
Kaspersky has given the technique a name: Shadow Token via Remote Debug, or STRD.
The delivery is theatre
Getting Umbrij onto a machine involves a bit of impersonation. A scheduled task is set up to masquerade as Kaspersky's own EDR product. That task launches a legitimately signed binary, which then side-loads a rogue .NET DLL obfuscated with ConfuserEx. Three variants have been spotted so far. Some include helper functions for debugging and picking which Google account to target. All of them keep meticulous logs, including the stolen authorisation code, ready for the operator to pick up on their next visit.
A pattern, not a one-off
ToddyCat has been running operations across Europe and Asia since 2020, and the target list keeps circling back to the same thing: corporate mailboxes. In November last year they were caught siphoning Outlook data using a custom tool called TCSectorCopy. Now it's Gmail through OAuth. The through-line is a group that would rather borrow a live, trusted session than fight its way past a login screen. Sessions don't have MFA prompts. Tokens don't get flagged as odd sign-ins from a new location. Once you're the browser, you're the user.
What Workspace admins can actually do
Kaspersky's practical tip is the kind of thing worth doing this week rather than next quarter. Have your users (or check centrally) visit myaccount.google.com/connections and look for two apps:
- Google Workspace Migration for Microsoft Outlook
- Google Workspace Sync for Microsoft Outlook
If your organisation isn't actively using either of them, revoke access. Doing so invalidates any OAuth tokens attackers may already have quietly banked, which is the outcome you want when the whole point of the attack is that the token, not the password, is the loot.
The broader lesson isn't complicated. Attackers have noticed that the login page is heavily defended and the authenticated session on the other side of it often isn't. Expect more tooling that lives inside the browser, borrows what's already there, and leaves the password alone entirely.