Back Thehackernews

ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API

Thehackernews • July 2, 2026

Learn how to uncover hidden AI use, see what data it can access, map every AI action to a human owner, and apply practical governance without heavy infrastructure changes.

Learn how to contain Mythos-style AI attacks with practical Zero Trust controls that reduce exposure, stop lateral movement, and limit risk.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ToddyCat Exploits OAuth to Compromise Gmail Accounts Using Umbrij Malware ToddyCat, an advanced persistent threat group, has adapted its tactics to exploit OAuth-based authorization flows, allowing them to compromise Gmail accounts without stealing user credentials. The group utilizes a malware variant called Umbrij, which is deployed on Windows systems through DLL sideloading. This method involves placing a malicious DLL next to legitimate executables that load libraries insecurely. The attack primarily targets corporate environments, raising concerns about data breaches and espionage. As of now, the full scope of the impact is still being assessed, but the potential for widespread access to sensitive information is significant. Organizations are urged to review their OAuth configurations and monitor for unusual access patterns. No specific CVEs have been reported yet regarding this method. 4 sources 52

Extracted Entities

ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Platforms (1)

Tools (1)