ToddyCat: your hidden email assistant. Part 1

ToddyCat APT has expanded its toolkit to target corporate email, evolving methods to covertly access employees’ correspondence in cloud and on‑premises environments, with incidents dating from the second half of 2024 into early 2025. In the first part of Securelist’s report, the ToddyCat group is shown using a PowerShell variant called TomBerBil to scrape browser data and exfiltrate it via SMB from domain controllers.

The researchers describe TCSectorCopy, a 32‑bit C++ tool used to copy OST files from Outlook even when they are locked, and XstReader, which exports the OST contents in HTML, RTF or TXT formats. The article also covers attempts to obtain access tokens from Outlook and Microsoft 365 processes, including SharpTokenFinder with fallbacks to ProcDump for memory dumps when EPP blocked initial access.

Detection guidance emphasises auditing Outlook folders for OST access, monitoring SMB‑based browser data theft, and watching for Office 365 process names in procdump command lines, according to Kaspersky. The piece notes that attackers relied on SMB to connect to remote hosts and to exfiltrate encrypted browser data alongside encryption keys used by DPAPI.