SECURITY analysts have identified the ToddyCat APT group utilizing the Umbrij tool to hijack corporate Gmail accounts, bypassing standard security measures through OAuth token theft. This malware operates in headless mode to conduct unauthorized access to enterprise networks. Key actions include exploiting DLL sideloading to run silently, using the Google API to request extensive permissions while mimicking legitimate applications, and maintaining ongoing access to sensitive information.
Researchers warn that the impact on compromised organizations can be severe, with advice for security teams to monitor for unusual activities and audit OAuth applications.