The STRD attack involves malware compromising a victim's machine and using a duplicated browser profile in headless debugging mode to silently perform OAuth authorization flows. The malware impersonates legitimate Google Workspace migration tools to request broad permissions and programmatically approves them via the DevTools protocol. This yields an OAuth token granting persistent access to Google Workspace mailboxes and data, which attackers can use remotely without further endpoint interaction. The technique bypasses two-factor authentication and cookie protections by leveraging legitimate OAuth mechanisms and browser session reuse. Detection can be aided by monitoring browser launches with debugging ports and restricting developer tools availability via group policies.

Attackers gain persistent, stealthy access to Google Workspace mailboxes and associated resources without needing passwords or active sessions on the victim's device. This access can survive password resets and does not trigger typical security alerts tied to credential theft or malware activity. The compromised OAuth tokens allow attackers to read emails and potentially access other corporate data, facilitating espionage or data exfiltration. The attack undermines two-factor authentication protections by exploiting OAuth authorization flows.

A fix is not applicable as this is an attack technique rather than a software vulnerability. Recommended mitigations include resetting affected users' passwords, terminating all active web sessions, revoking OAuth tokens and third-party app permissions, and reviewing legacy app password access. Organizations should restrict the ability of standard users to launch browsers in debugging mode using DeveloperToolsAvailability group policies for Chrome and Edge. Additionally, monitoring for browser instances launched with debugging ports in SIEM/XDR systems can help detect this attack technique. Kaspersky products detect and protect against the Umbrij malware implementing this attack.