Cybersecurity researchers have uncovered a new malware tool called Umbrij, which is being used by the advanced persistent threat (APT) group ToddyCat to gain unauthorized access to corporate Gmail accounts. Instead of stealing usernames and passwords, the malware abuses Google’s OAuth authorization process to obtain access tokens, allowing attackers to read emails through the Google API. This new technique helps the attackers remain hidden while accessing sensitive business communications.
According to researchers, Umbrij specifically targets users who are already signed in to Gmail on Chromium-based browsers such as Google Chrome and Microsoft Edge. The malware connects to the browser using its remote debugging feature and silently requests authorization within the existing login session. It then captures an OAuth authorization code without requiring the victim to enter their password again.
After obtaining the authorization code, the malware exchanges it for a valid OAuth access token. This token is then used to connect directly to Gmail through Google’s API, giving attackers access to the victim’s mailbox. Because the attack relies on OAuth tokens instead of stolen passwords, traditional credential-based security monitoring may not immediately detect the compromise. Researchers have named this attack method Shadow Token via Remote Debug (STRD).
The investigation found that Umbrij is delivered using a technique known as DLL sideloading. Attackers abuse legitimate digitally signed applications that are vulnerable to loading malicious DLL files, making the malware appear as trusted software. Researchers observed multiple legitimate executables being used to launch different versions of Umbrij while helping the attackers avoid suspicion during execution.
Researchers also discovered that the malware exists in several versions and is written in .NET with code protected using the ConfuserEx obfuscation tool. The malware includes functions for locating browser profiles, identifying user accounts, checking browser debugging ports, and automating the entire OAuth authorization process. These capabilities allow the attackers to perform the attack efficiently with very little manual interaction.
The campaign mainly focuses on compromising corporate Gmail accounts because many organizations rely on Google Workspace for business communication. If a user has not signed out of their Google account, the browser keeps the session active. Umbrij takes advantage of this active session to request access permissions and retrieve the authorization code, which is later converted into an access token for Gmail API access.
Security experts recommend monitoring systems for suspicious DLL sideloading activity, unexpected browser launches in developer or remote debugging mode, and unauthorized third-party applications connected to Google accounts. Organizations should also regularly review OAuth permissions granted to applications and instruct employees to sign out of their Google accounts after completing their work to reduce the risk of session-based attacks.
The discovery of Umbrij shows that ToddyCat continues to improve its attack techniques to bypass modern security defenses and gain long-term access to corporate email communications. By abusing legitimate OAuth authentication instead of stealing passwords, the group has introduced a more advanced method for compromising Gmail accounts. Researchers believe organizations should strengthen endpoint monitoring and carefully monitor OAuth activity to defend against this evolving threat.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
