ToddyCat-Linked Umbrij Malware Abuses OAuth via 'Shadow Token via Remote Debug' (STRD) to Access Gmail, Drive, Calendar and Contacts — Threadlinqs Intelligence
As of 2026-07-02, ToddyCat-Linked Umbrij Malware Abuses OAuth via 'Shadow Token via Remote Debug' (STRD) to Access Gmail, Drive, Calendar and Contacts is a high-severity apt threat attributed to ToddyCat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 27 indicators of compromise.
Threat ID: TL-2026-1072 · Severity: HIGH · Status: ACTIVE · Category: APT
Attribution: ToddyCat · ESPIONAGE
Kaspersky attributes a new .NET-based credential theft tool named Umbrij to the ToddyCat APT group. Umbrij is deployed via DLL side-loading on three signed legitimate executables and launches a
ToddyCat, an APT group active since at least December 2020 that has historically targeted government, military and military-contractor organizations across Europe and Asia (initially Taiwan and Vietnam via Microsoft Exchange/ProxyLogon, later expanding to Afghanistan, India, Iran, Malaysia, Pakistan, Russia, Slovakia, Thailand, Kyrgyzstan, Uzbekistan, Indonesia and the UK), has been linked by Kaspersky's GReAT team to a new .NET credential-theft tool called Umbrij (observed in versions a, b and c; Kaspersky detections HEUR:Trojan-PSW.MSIL.Umbrij.gen, HEUR:Trojan.MSIL.Agent.gen, HEUR:Trojan-PSW.MSIL.Agent.gen). Umbrij is packed with the open-source ConfuserEx .NET obfuscator to hinder static analysis and reverse engineering.
Umbrij is delivered to compromised Windows hosts via DLL side-loading against three legitimately signed executables: BDSubWiz.exe (Bitdefender ConnectAgent, side-loads log.dll), VSTestVideoRecorder.exe (Microsoft Visual Studio Test component, side-loads Microsoft.VisualStudio.QualityTools.VideoRecorderEngine.dll), and GoogleDesktop.exe (Google Desktop Search, side-loads GoogleServices.dll). Attackers copy the legitimate signed binary and the malicious loader DLL into user-writable locations such as C:\Users\Public\ and C:\windows\vss\, and have been observed persisting via a scheduled task masquerading under the name 'KasperskyEndpointSecurityEDRAvp' to blend in with legitimate Kaspersky endpoint security tooling.
Once running, Umbrij enumerates local Chromium browser profiles (Chrome and Edge) via command-line flags (-regex to match a target email substring, -user to scope to a Windows user, -browser to choose msedge/chrome/both, -deepsearch for verified profile matching, -savepdf to screenshot matched profiles as PDF evidence). For each matched profile it copies profile artifacts needed to reproduce an authenticated browsing context — IndexedDB, Local Storage, Network cache, Login Data, Login Data For Account, Preferences, Secure Preferences, Web Data and the top-level Local State JSON (normally at %LOCALAPPDATA%\Google\Chrome\User Data\Local State) — into a working directory.
Umbrij then launches a hidden/headless instance of the target Chromium browser using the copied profile with the flags --headless and --remote-debugging-port=<port>, and uses the Puppeteer Sharp .NET library to drive the browser over the Chrome DevTools Protocol (CDP). Because the copied profile already contains valid Google authentication cookies, Google treats the automated session as the legitimate, already-authenticated user and does not prompt for re-authentication or MFA. Umbrij programmatically navigates to Google's OAuth2 authorization endpoint (accounts.google.com/o/oauth2/v2/auth) impersonating one of two pre-registered, Google-verified third-party OAuth client applications — 'Google Workspace Migration for Microsoft Outlook' (GWMMO, client ID 279448736670) or, when the -sync flag is used, 'Google Workspace Sync for Microsoft Outlook' (GWSMO, client ID 1095133494869) — and requests broad delegated scopes covering Gmail (mail.google.com), Drive, Calendar, Admin Directory, Contacts and Tasks. Because the session is already authenticated and the OAuth client is a Google-trusted first/third-party integration, Google's consent flow silently issues an authorization code in the redirect URL, which Umbrij intercepts via CDP network inspection and exchanges directly for an OAuth access (and refresh) token via the Google token endpoint — without ever touching the account password, without an interactive consent screen in many enterprise/Workspace configurations, and without generating a traditional 'new sign-in' security alert. Kaspersky has named this technique 'Shadow Token via Remote Debug' (STRD). The resulting access token gives the attacker durable, credential-less API access to the victim's Gmail, Drive, Calendar, Contacts and Tasks data, functioning as a stealthy, non-malware persistence and collection mechanism that surv
Target sectors: government administration, military, defense-contractors, corporate-enterprise
Target regions: Europe, Asia, Southeast Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 27 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, HIGH, threat intelligence, cybersecurity, T1574, T1574, T1574, T1036, T1027, T1550, T1550, T1134, T1134, T1528