Back Feeds.4Sysops

ToddyCat APT uses remote debugging to hijack Gmail OAuth tokens

Feeds.4Sysops •IT News • July 2, 2026

The ToddyCat threat group is deploying a .NET-based malware called Umbrij that automates the compromise of corporate Gmail accounts without stealing passwords. The attack utilizes a technique known as Shadow Token via Remote Debug (STRD) to exploit active browser sessions on Windows hosts. Attackers gain initial access through DLL sideloading, often masquerading as legitimate components of Bitdefender, Visual Studio, or legacy Google software. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ToddyCat Exploits OAuth to Compromise Gmail Accounts Using Umbrij Malware ToddyCat, an advanced persistent threat group, has adapted its tactics to exploit OAuth-based authorization flows, allowing them to compromise Gmail accounts without stealing user credentials. The group utilizes a malware variant called Umbrij, which is deployed on Windows systems through DLL sideloading. This method involves placing a malicious DLL next to legitimate executables that load libraries insecurely. The attack primarily targets corporate environments, raising concerns about data breaches and espionage. As of now, the full scope of the impact is still being assessed, but the potential for widespread access to sensitive information is significant. Organizations are urged to review their OAuth configurations and monitor for unusual access patterns. No specific CVEs have been reported yet regarding this method. 4 sources 52

Extracted Entities

ToddyCat APT uses remote debugging to hijack Gmail OAuth tokens

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Malware (1)

Platforms (2)

Tools (1)