Loading story…
Kaspersky researchers reported that the ToddyCat APT group is using a new .NET malware tool, Umbrij, to compromise corporate Gmail accounts and other Google resources by abusing Google OAuth flows in Chromium-based browsers. The malware is delivered through DLL sideloading with legitimate executables including BDSubWiz.exe, VSTestVideoRecorder.exe, and GoogleDesktop.exe, and can also persist through masqueraded scheduled tasks. After execution, Umbrij reuses an already authenticated browser profile, launches Chrome or Edge in headless mode with a remote debugging port, and automates account-selection and consent steps to capture an OAuth authorization code.
The attackers then exchange the stolen code for Google access tokens and use the API to access Gmail and other account data while remaining largely invisible to the victim. Researchers named the technique Shadow Token via Remote Debug (STRD) and said it depends on an active Google session already present in the victim’s browser; in some cases the malware also impersonates the user by duplicating an explorer.exe token. Defenders were advised to monitor for DLL sideloading and suspicious Chromium launches using flags such as ```
--remote-debugging-port
--headless
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
On 2021-05-13, Securelist published a report describing ToddyCat's use of the Umbrij .NET malware to abuse Google OAuth flows via Chromium remote debugging and access Gmail and other Google resources. The report named the technique Shadow Token via Remote Debug (STRD) and included detection and mitigation guidance.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
7 references tracked. Mallory keeps watching after this page renders.
kaspersky.ru
Open sourcekaspersky.com
Open sourcethehackernews.com
Open sourcedatabreaches.net
Open sourcesecurelist.ru
Open sourcechromeenterprise.google
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The ToddyCat advanced persistent threat (APT) group has evolved its attack methods, shifting focus from browser credential theft to targeting Outlook email archives and Microsoft 365 access tokens. Recent research by Kaspersky highlights the use of new custom tools, such as TCSectorCopy and updated versions of TomBerBil, which enable the group to extract entire email archives and OAuth 2.0 tokens from compromised corporate environments. These tokens can be used to access corporate mail outside the victim's infrastructure, increasing the risk of data exfiltration and unauthorized access. The updated TomBerBil toolkit, now observed running as a PowerShell variant on domain controllers with privileged access, leverages scheduled tasks and the SMB protocol to collect browser data—including cookies, saved credentials, and history—from remote hosts. By capturing Windows DPAPI encryption keys, ToddyCat can decrypt sensitive information for offline analysis. The group has also exploited vulnerabilities such as CVE-2024-11859 in ESET Command Line Scanner to deliver new malware, further expanding its capabilities to target organizations across Europe and Asia.
Jun 29, 2026
Kimsuky was linked to an espionage campaign targeting individuals in South Korea and Japan through phishing emails that delivered OneDrive-hosted archives containing malicious `LNK` shortcut files. When opened, the shortcut displayed a decoy document while hidden `VBE`, PowerShell, and batch scripts downloaded follow-on payloads, established persistence with scheduled tasks, collected system information, and stole email data from Thunderbird, Outlook, and Gmail. Researchers also reported in-memory C# keylogging and rapid rotation of command-and-control infrastructure, including the use of compromised Korean servers to complicate tracing. A key element of the operation was a malicious Chrome extension disguised in Korean as **“Gmail automatic server uploader,”** which monitored Gmail activity and exfiltrated message metadata, message bodies, and attachments to attacker-controlled servers. The intrusion chain also installed legitimate remote-access tools including **Chrome Remote Desktop** and **AnyDesk** for hands-on control, with Chrome Remote Desktop elevated via a `fodhelper.exe` UAC bypass and AnyDesk maintained through scheduled-task persistence. Enki attributed the activity to Kimsuky based on tooling, targeting, and operational patterns, and assessed that Korean comments, debugging text, and emoji in the extension code strongly suggest generative AI helped produce much of the malware component.
Aug 24, 2026
Google Threat Intelligence Group and Mandiant disclosed that a newly tracked threat cluster, **UNC6692**, breached enterprise networks by posing as IT help desk staff in Microsoft Teams after first overwhelming targets with high-volume spam emails. Victims were persuaded to accept chats from external Teams accounts and visit a fake **"Mailbox Repair Utility"** or **"Mailbox Repair and Sync Utility"** page, which harvested credentials with a double-entry trick that intentionally rejected the first password submissions before installing malware. The campaign relied on trusted cloud services including **AWS S3** and **Heroku** for payload delivery, command-and-control, and exfiltration, allowing the activity to blend into normal enterprise traffic without exploiting a software vulnerability. After initial access, UNC6692 deployed the modular **SNOW** malware suite, including **SNOWBELT** for browser-extension persistence and command relay, **SNOWGLAZE** for tunneling and proxying, and **SNOWBASIN** for remote command execution, screenshots, and file transfer, alongside AutoHotkey scripts and a portable Python environment. Investigators said the attackers scanned internal networks, used **PsExec** and **RDP** to pivot to a backup server, dumped **LSASS** memory, performed **Pass-the-Hash** against domain controllers, and used **FTK Imager** to steal **`NTDS.dit`** and registry hives before exfiltrating data through LimeWire. Google said the tradecraft resembles social-engineering operations associated with other criminal actors but found no confirmed overlap, and the campaign appears separate from other recently reported Teams-based help desk impersonation activity.
Jun 29, 2026