CyberSIXT Search
Threat actor

ToddyCat

China

Tracked by CyberSIXT since 21 Nov 2025

Articles · all time
7
Articles · last 30 days
0
CVEs exploited · attributed · all time
0
Research reports · all time
1

8 articles from 1 outlet since 21 Nov 2025; the latest 115 days ago.

ToddyCat: coverage over time8 articles from 1 outlet, 4 of them before 25 Oct 2025. First report 21 Nov 2025 by Securelist. Busiest week: 4 articles, week of 29 Jun. 0 in the last 7 days. ToddyCat: coverage over time8 articles from 1 outlet, 4 of them before 25 Oct 2025. First report 21 Nov 2025 by Securelist. Busiest week: 4 articles, week of 29 Jun. 0 in the last 7 days.
  • Article
  • First report
  • Research report
Show as table
ToddyCat: articles
Published (UTC)OutletHeadline
Fri 3 Jul · 08:13 UTCSecurityOnlineToddyCat APT hijacks corporate Gmail via Umbrij OAuth theft
Thu 2 Jul · 14:11 UTCThe Hacker NewsUmbrij Malware Hijacks Gmail via OAuth, Raising Security Fears
Tue 30 Jun · 17:21 UTCDataBreachesKaspersky Warns of ToddyCat Gmail Hack via Shadow Token Technique
Tue 30 Jun · 10:11 UTCSecurelistToddyCat APT’s Umbrij Tool Steals Corporate Gmail via Google API
Fri 19 Dec 2025 · 14:40 UTCSecurityWeekChinese APT ‘LongNosedGoblin’ Targeting Asian Governments
Tue 25 Nov 2025 · 12:45 UTCThe Hacker NewsToddyCat’s New Hacking Tools Steal Outlook Emails and Microsoft 365 Access Tokens
Tue 25 Nov 2025 · 00:50 UTCSecurityOnlineToddyCat APT Steals Microsoft 365 Cloud Email by Dumping OAuth Tokens from Memory and Copying Locked OST Files
Fri 21 Nov 2025 · 10:40 UTCSecurelistToddyCat: your hidden email assistant. Part 1
See the full timeline

Names and sources

ToddyCat
Named by CyberSIXT coverage
ToddyCat APT
Named by CyberSIXT coverage
ToddyCat
Named by Malpedia · toddycat
Websiic
Named by Malpedia · toddycat
Storm-0247
Named by Microsoft · Storm-0247
ToddyCat
Named by Microsoft · Storm-0247
Websiic
Named by Microsoft · Storm-0247
ToddyCat
Named by MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b
All 11 names
Websiic
Named by MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b
ToddyCat
Named by MITRE ATT&CK® · G1022
091a0b69-74de-44b6-bb12-16b7a8fd078b
Named by CyberSIXT coverage

Attributed facts

category
state (Microsoft · Storm-0247)
origin
China (Microsoft · Storm-0247)
sector
Government (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
sector
Military (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
Target country
Afghanistan (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
Target country
India (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
Target country
Indonesia (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
Target country
Iran (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
Target country
Kyrgyzstan (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
Target country
Malaysia (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
Target country
Pakistan (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
Target country
Russia (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
Target country
Slovakia (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
Target country
Taiwan (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
Target country
Thailand (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
Target country
United Kingdom (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
Target country
Uzbekistan (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
Target country
Vietnam (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)

Malware and tools

China Chopper (MITRE ATT&CK® · G1022) Net (MITRE ATT&CK® · G1022) Ping (MITRE ATT&CK® · G1022) netstat (MITRE ATT&CK® · G1022) Cobalt Strike (MITRE ATT&CK® · G1022) Samurai (MITRE ATT&CK® · G1022) Ninja (MITRE ATT&CK® · G1022) LoFiSe (MITRE ATT&CK® · G1022) Pcexter (MITRE ATT&CK® · G1022)

MITRE ATT&CK® techniques

From MITRE ATT&CK® · G1022

Execution
T1047
Windows Management Instrumentation
T1053.005
Scheduled Task
T1059.001
PowerShell
T1059.003
Windows Command Shell
Persistence
T1053.005
Scheduled Task
Privilege Escalation
T1053.005
Scheduled Task
Stealth
T1036.005
Match Legitimate Resource Name or Location
Discovery
T1018
Remote System Discovery
T1049
System Network Connections Discovery
T1057
Process Discovery
T1069.002
Domain Groups
Lateral Movement
T1021.002
SMB/Windows Admin Shares
Collection
T1005
Data from Local System
T1074.002
Remote Data Staging

© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK

Subject articles only

Coverage

8 articles, all timeFull timeline RSS feed
  1. ToddyCat APT hijacks corporate Gmail via Umbrij OAuth theftSecurityOnline
  2. Umbrij Malware Hijacks Gmail via OAuth, Raising Security FearsThe Hacker News
  3. Kaspersky Warns of ToddyCat Gmail Hack via Shadow Token TechniqueDataBreaches
  4. ToddyCat APT’s Umbrij Tool Steals Corporate Gmail via Google APISecurelist
  5. Chinese APT ‘LongNosedGoblin’ Targeting Asian GovernmentsSecurityWeek
  6. ToddyCat’s New Hacking Tools Steal Outlook Emails and Microsoft 365 Access TokensThe Hacker News
  7. ToddyCat APT Steals Microsoft 365 Cloud Email by Dumping OAuth Tokens from Memory and Copying Locked OST FilesSecurityOnline
  8. ToddyCat: your hidden email assistant. Part 1Securelist · first in our coverage

Research reports

Learn more

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device