Umbrij is a sophisticated malware tool developed by the ToddyCat APT group to compromise Gmail corporate accounts through OAuth token theft. It exploits Chromium-based browsers by launching them in headless mode with remote debugging enabled, using the Shadow Token via Remote Debug (STRD) technique. The malware automates the attack chain by copying user profiles, launching browsers with debugging ports, connecting via the Puppeteer Sharp library, and manipulating OAuth authorization flows by impersonating legitimate Google Workspace migration tools. It specifically targets client IDs associated with Google Workspace Migration for Microsoft Outlook and Google Workspace Sync applications, requesting extensive permissions to access email, calendar, drive, and contacts data. ToddyCat deploys Umbrij through DLL sideloading techniques, leveraging signed files from Bitdefender, Visual Studio, and Google Desktop Search to evade detection. This approach allows scalable compromise of organizational email communications while bypassing traditional security monitoring.

Successful exploitation results in unauthorized access to corporate Gmail accounts by stealing OAuth tokens, potentially exposing sensitive email communications, calendar entries, drive files, and contacts. The attack leverages legitimate OAuth flows and trusted client IDs, increasing the likelihood of bypassing security controls. The use of DLL sideloading with signed binaries aids evasion of endpoint security solutions. There are no known exploits in the wild reported at this time.

No official patch or remediation guidance is provided in the available data. Organizations should monitor for suspicious use of Chromium-based browsers in headless mode with remote debugging enabled and investigate DLL sideloading activities involving signed files from Bitdefender, Visual Studio, and Google Desktop Search. Reviewing OAuth client permissions and restricting use of Google Workspace migration tools where possible may reduce risk. Employing multi-factor authentication and monitoring OAuth token usage can help detect unauthorized access. Patch status is not yet confirmed — check vendor advisories and trusted threat intelligence sources for updates.