Skip to content

CyberSIXT Search

Threat actor · coverage timeline

ToddyCat

7 articles from 4 outlets between 21 Nov 2025 and 3 Jul. First reported by Securelist. The busiest day was Tue 30 Jun, with 2 articles.

Articles: 7; all time · from 4 outlets
Days with coverage: 5; of 225 days · all time
Busiest day · all time: 2; articles on Tue 30 Jun
Last 7 days: 0a day; vs 0 a day · previous 7 days
First report: 21 Nov 2025; Securelist
CVEs named: 0; in these articles

Coverage over time

7 articles · 21 Nov 2025 – 3 Jul

21 Nov 2025First report21 Nov 2025 · Securelist

Show as table

ToddyCat: articles per day
Day (UTC)	Articles	Outlets
Fri 21 Nov 2025	1	Securelist 1
Tue 25 Nov 2025	2	SecurityOnline 1, The Hacker News 1
Tue 30 Jun	2	Securelist 1, DataBreaches 1
Thu 2 Jul	1	The Hacker News 1
Fri 3 Jul	1	SecurityOnline 1

Articles

7 articles

Fri 3 Jul1 article

08:13
ToddyCat APT hijacks corporate Gmail via Umbrij OAuth theftSecurityOnline

Thu 2 Jul1 article

14:11
Umbrij Malware Hijacks Gmail via OAuth, Raising Security FearsThe Hacker News

Tue 30 Jun2 articles

17:21
Kaspersky Warns of ToddyCat Gmail Hack via Shadow Token TechniqueDataBreaches
10:11
ToddyCat APT’s Umbrij Tool Steals Corporate Gmail via Google APISecurelist

Tue 25 Nov 2025 20252 articles

12:45
ToddyCat’s New Hacking Tools Steal Outlook Emails and Microsoft 365 Access TokensThe Hacker News
00:50
ToddyCat APT Steals Microsoft 365 Cloud Email by Dumping OAuth Tokens from Memory and Copying Locked OST FilesSecurityOnline

Fri 21 Nov 2025 20251 article

10:40
ToddyCat: your hidden email assistant. Part 1Securelist · first report