The Umbrij malware linked to the ToddyCat threat group demonstrates how attackers can abuse legitimate OAuth authorization processes to gain persistent access to corporate Gmail accounts.

Umbrij takes control of an active Chromium browser session through its remote debugging interface. If the victim is already signed into Gmail, the malware requests access on behalf of trusted Google applications and captures the resulting OAuth authorization code.

The attackers then exchange this code for an access token and use the Gmail API to read corporate email without repeatedly entering the victim’s password. This activity may also bypass monitoring focused mainly on browser logins or suspicious interactive sessions.

The malware is loaded through DLL side-loading using legitimate software components, helping it blend into normal system activity. It also automates the authorization process through a headless browser, allowing attackers to compromise email accounts more efficiently.

Organizations should restrict browser remote-debugging features, monitor unusual OAuth consent activity, and review applications connected to Google Workspace accounts. Unnecessary access granted to Google Workspace Migration for Microsoft Outlook or Google Workspace Sync for Microsoft Outlook should be revoked.

Security teams should also investigate unexpected DLL side-loading, unusual headless browser activity, and Gmail API access from unfamiliar applications or locations.

The key lesson is that changing a password may not remove an attacker who already holds a valid OAuth token. Organizations must revoke suspicious application access and active tokens, because attackers no longer need to keep stealing the password when the cloud platform has already issued them a key.

The threat actor known as ToddyCat has been attributed to a new malware called Umbrij that's designed to gain surreptitious access to a victim's email correspondence via the Google API. "In this campaign, the attackers focused their attention on corporate email communications hosted on Gmail, targeting access compromise via APIs," Kaspersky said in a detailed report published this week. "

Source: ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API via The Hacker News — published 02 Jul 2026.