ToddyCat APT Steals Microsoft 365 Cloud Email by Dumping OAuth Tokens from Memory and Copying Locked OST Files

Kaspersky Lab has reported that the ToddyCat APT group has enhanced its cyber-espionage techniques to infiltrate corporate email systems, including Microsoft 365, by stealing browser data, Outlook mail archives, and OAuth 2.0 access tokens. The report highlights a new PowerShell variant of the TomBerBil tool that operates on domain controllers and harvests browser files across networks. Additionally, the attackers have developed a custom tool, TCSectorCopy, to extract locked Outlook OST files directly from disk.

They also target OAuth tokens stored in memory to access cloud email, bypassing traditional security measures. The findings indicate a significant evolution in the group's tactics, posing a growing threat to organizations using hybrid or cloud-based email platforms.