Loading story…
The ToddyCat advanced persistent threat (APT) group has evolved its attack methods, shifting focus from browser credential theft to targeting Outlook email archives and Microsoft 365 access tokens. Recent research by Kaspersky highlights the use of new custom tools, such as TCSectorCopy and updated versions of TomBerBil, which enable the group to extract entire email archives and OAuth 2.0 tokens from compromised corporate environments. These tokens can be used to access corporate mail outside the victim's infrastructure, increasing the risk of data exfiltration and unauthorized access.
The updated TomBerBil toolkit, now observed running as a PowerShell variant on domain controllers with privileged access, leverages scheduled tasks and the SMB protocol to collect browser data—including cookies, saved credentials, and history—from remote hosts. By capturing Windows DPAPI encryption keys, ToddyCat can decrypt sensitive information for offline analysis. The group has also exploited vulnerabilities such as CVE-2024-11859 in ESET Command Line Scanner to deliver new malware, further expanding its capabilities to target organizations across Europe and Asia.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
Kaspersky publicly reported that ToddyCat had revamped its tooling to steal Outlook email archives and Microsoft 365 access tokens, and shared indicators of compromise such as filenames and paths. Multiple outlets then covered the findings, highlighting the group's updated post-exploitation tradecraft.
As defenders blocked browser-based token extraction, ToddyCat adapted by dumping memory from the Outlook process with Sysinternals ProcDump to recover Microsoft 365 access tokens. This reflected the group's ongoing refinement of techniques to maintain access while evading detection.
In April 2025, ToddyCat exploited CVE-2024-11859 in ESET Command Line Scanner during a campaign to execute malicious modules via trusted processes. The activity showed the group continuing to refresh its malware delivery and evasion methods.
In late 2024 and early 2025, ToddyCat evolved from primarily stealing browser credentials to targeting corporate email data. The group began extracting Outlook OST archives with its TCSectorCopy tool and harvesting Microsoft 365 OAuth tokens, including by using SharpTokenFinder and parsing mail data with XstReader.
Kaspersky observed ToddyCat intrusions between May and June 2024 using a PowerShell-based TomBerBil variant. The malware ran from domain controllers and collected browser artifacts, including DPAPI-related material and Firefox data, to enable offline decryption and credential reuse.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcecsoonline.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ToddyCat is a sophisticated cyber espionage group that has targeted high-profile organizations across Europe and Asia since 2020, initially compromising Microsoft Exchange servers in Taiwan and Vietnam using an unidentified vulnerability. The group rapidly expanded its operations in early 2021 by exploiting the ProxyLogon vulnerability, enabling them to move beyond regional targets and establish a global presence. Their campaigns involve deploying multiple malware variants, such as China Chopper web shells, Samurai backdoors, and Ninja Trojan loaders, with later operations introducing advanced tools like TCESB to exploit security products and PowerShell-based credential harvesting scripts. ToddyCat demonstrates a deep understanding of Windows security architecture, employing scheduled tasks, PowerShell commands with bypass flags, and sophisticated defense evasion techniques including BYOVD, DLL side-loading, and reverse SSH tunnels to maintain persistence and avoid detection. The group’s lateral movement is facilitated through SMB shares, and they use specialized tools like TCSectorCopy to bypass file locks and extract sensitive data, which is then compressed and exfiltrated over command-and-control channels. Their evolving toolkit and operational security measures highlight a continuous adaptation to security defenses, making them a persistent threat to organizations worldwide. Security analysts have mapped ToddyCat’s tactics, techniques, and procedures to MITRE ATT&CK, providing defenders with actionable intelligence to simulate and mitigate these advanced threats.
Jun 29, 2026
Kaspersky researchers reported that the **ToddyCat** APT group is using a new .NET malware tool, **Umbrij**, to compromise corporate Gmail accounts and other Google resources by abusing Google OAuth flows in Chromium-based browsers. The malware is delivered through **DLL sideloading** with legitimate executables including `BDSubWiz.exe`, `VSTestVideoRecorder.exe`, and `GoogleDesktop.exe`, and can also persist through masqueraded scheduled tasks. After execution, Umbrij reuses an already authenticated browser profile, launches Chrome or Edge in headless mode with a remote debugging port, and automates account-selection and consent steps to capture an OAuth authorization code. The attackers then exchange the stolen code for Google access tokens and use the API to access Gmail and other account data while remaining largely invisible to the victim. Researchers named the technique **Shadow Token via Remote Debug (STRD)** and said it depends on an active Google session already present in the victim’s browser; in some cases the malware also impersonates the user by duplicating an `explorer.exe` token. Defenders were advised to monitor for DLL sideloading and suspicious Chromium launches using flags such as ``` --remote-debugging-port --headless ```, and to revoke unauthorized third-party Google app access, including **Google Workspace Migration for Microsoft Outlook** and **Google Workspace Sync for Microsoft Outlook**.
Jul 17, 2026
Researchers detailed **StrelaStealer**, an email-focused credential theft malware active since at least late 2022, that steals account data and mailbox information from **Microsoft Outlook** and **Mozilla Thunderbird**. The malware has been observed in campaigns affecting victims in Italy and appears to favor Spanish-speaking targets based on lure content and error messages. Analysis indicates the same actor likely develops and operates the malware, with the codebase evolving from DLL-based samples with encrypted strings to newer signed PE variants, including both 32-bit and 64-bit builds. Technical analysis showed the delivery component uses a more sophisticated packer with control-flow obfuscation and hides an XOR-encoded PE payload in the `.data` section using a 20-byte rolling XOR key. Once launched, Strela enforces single-instance execution with a mutex, harvests Thunderbird and Outlook credentials, shows a decoy error to the victim, and exfiltrates data over HTTP POST to hard-coded command-and-control endpoints including `91.215.85.209/server.php` and `193.106.191.166/server.php`. Investigators also found evidence that the server validates submitted Thunderbird data, including JSON and SQLite content, suggesting the stolen information is actively processed rather than simply collected.
Aug 15, 2026