ToddyCat’s Umbrij steals Gmail OAuth tokens for silent, persistent access
Kaspersky uncovered Umbrij, a custom tool the ToddyCat APT uses to hijack Gmail accounts via OAuth token theft. By attaching to a Chromium browser’s remote‑debug port, the malware silently grabs a “shadow token” and gains persistent API access to email and other Google services. Detect it via unusual scheduled tasks, DLL sideloading, and Kaspersky’s heuristic verdicts.