ToddyCat Uses Shadow Token via Remote Debug to Compromise Gmail Accounts

Gbhackers •Mayura Kathir • July 1, 2026

ToddyCat, an advanced persistent threat group long associated with targeted espionage against corporate environments, has evolved its toolkit to exploit OAuth-based authorization flows and compromise Gmail accounts without directly stealing credentials. Umbrij is deployed on Windows hosts using DLL sideloading: attackers place a malicious DLL alongside legitimately signed executables known to insecurely load libraries (examples […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ToddyCat Exploits OAuth to Compromise Gmail Accounts Using Umbrij Malware ToddyCat, an advanced persistent threat group, has adapted its tactics to exploit OAuth-based authorization flows, allowing them to compromise Gmail accounts without stealing user credentials. The group utilizes a malware variant called Umbrij, which is deployed on Windows systems through DLL sideloading. This method involves placing a malicious DLL next to legitimate executables that load libraries insecurely. The attack primarily targets corporate environments, raising concerns about data breaches and espionage. As of now, the full scope of the impact is still being assessed, but the potential for widespread access to sensitive information is significant. Organizations are urged to review their OAuth configurations and monitor for unusual access patterns. No specific CVEs have been reported yet regarding this method. 4 sources 52

Extracted Entities

ToddyCat Uses Shadow Token via Remote Debug to Compromise Gmail Accounts

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)