The advanced persistent threat (APT) group known as ToddyCat has expanded its cyber-espionage capabilities with a new .NET-based malware called Umbrij, designed to automate the compromise of Gmail accounts.
Unlike traditional credential theft attacks, the malware abuses Google’s OAuth authorization process to obtain access tokens, allowing attackers to access corporate email accounts without stealing passwords.
The newly discovered tool is heavily obfuscated using ConfuserEx, making analysis and detection significantly more difficult while helping it evade security solutions.
Researchers found that Umbrij specifically targets organizations using Gmail for business communications. The malware focuses on active browser sessions where users are already authenticated.
By leveraging Chromium browser debugging features, it silently requests OAuth permissions on behalf of the victim and captures authorization codes that can later be exchanged for valid access tokens.
ToddyCat Automates Gmail Compromise
The attack begins after the malware is launched through DLL sideloading, a technique ToddyCat has repeatedly used in previous campaigns.
Instead of executing directly, Umbrij hides inside trusted applications vulnerable to DLL hijacking, including legitimate executables from Bitdefender ConnectAgent, Microsoft Visual Studio testing tools, and the discontinued Google Desktop Search software.
The attackers also disguise execution using fake scheduled tasks that resemble legitimate security software.
The malware itself is written in the .NET framework and protected with the open-source ConfuserEx obfuscator. This protection makes reverse engineering considerably harder while concealing its internal logic from analysts.
Once running, Umbrij first prepares the victim’s environment.
It checks whether a remote debugging port is available and impersonates the logged-in user by duplicating the security token from the Windows explorer.exe process.
This enables the malware to operate with the victim’s permissions and access their browser profile. Next, Umbrij searches Chrome and Microsoft Edge profile directories for authenticated Google accounts.
It identifies browser profiles containing Gmail addresses and copies important browser data including login information, cookies, local storage, IndexedDB databases, preferences, and session files into a temporary backup location.
Even files locked by running browser processes are forcefully copied using dedicated routines.
The malware then launches a hidden Chromium browser using the copied profile with several command-line arguments, including –headless and –remote-debugging-port.
Since the copied browser profile already contains active authentication cookies, Google recognizes the session as legitimate and does not request another login, securelist said.
After the browser starts, Umbrij connects through the Chromium DevTools protocol using the Puppeteer Sharp automation framework.
It automatically opens a specially crafted Google OAuth authorization request that impersonates legitimate Google Workspace applications such as Google Workspace Migration for Microsoft Outlook and Google Workspace Sync for Microsoft Outlook.
Although the malware uses legitimate Google application identifiers, it modifies several authorization parameters.
It removes important OAuth security values such as PKCE verification, changes redirect locations, and requests broad permissions covering Gmail, Google Drive, Calendar, Contacts, Tasks, user profile information, and administrative services.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 group known as ToddyCat has expanded its cyber-espionage capabilities with a new .NET-based malware){kind=link}