ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API

1. Executive summary

Kaspersky GReAT has published details of a new toolset dubbed "Umbrij," attributed to the ToddyCat APT (MITRE G1022), which abuses the Chromium remote debugging port to steal OAuth 2.0 access tokens from active Gmail sessions. The technique — codenamed Shadow Token via Remote Debug (STRD) — allows the attacker to read corporate email, calendar data, and other Google service resources via the Google API while evading EPP/EDR monitoring. EMEA financial services organisations using Chromium-based browsers to access corporate Gmail are at direct risk of long-term, undetected email compromise. Attribution to ToddyCat is confirmed via MITRE profile G1022; however, the technical detail in this advisory is single-sourced (Kaspersky) and should be verified before enforcement.

2. Regulatory framing

3. Technical analysis & attack chain

Attack chain (confirmed steps)

1. Initial access / delivery. A scheduled task named KasperskyEndpointSecurityEDRAvp is created on the victim host. This name is deliberately chosen to masquerade as a legitimate Kaspersky process — Kaspersky does not create scheduled tasks with this name. The task launches a digitally signed legitimate binary.
2. DLL side-loading. The signed binary is one of three identified legitimate executables vulnerable to DLL side-loading: - BDSubWiz.exe — Submission Wizard component of Bitdefender ConnectAgent - VSTestVideoRecorder.exe — video-recording tool for Microsoft Visual Studio testing - GoogleDesktop.exe — discontinued Google Desktop Search application

The legitimate binary loads the malicious Umbrij DLL in place of the expected legitimate DLL.

3. Umbrij execution. Umbrij is a .NET DLL obfuscated with ConfuserEx. It accepts command-line parameters. Observed command line: "c:\Users\Public\BDSubWiz.exe" -regex <name> -deepsearch c:\windows\vss\bds.exe Additional parameters vary by Umbrij version (a, b, c) and include switches to specify target browser (Google Chrome or Microsoft Edge), instruct the tool to save a screenshot of the user profile as a PDF, and specify the system username under which the tool will run (-user <username>).
4. Preparatory actions on the host: - Verifies availability of the port designated for browser debugging. - Retrieves user context by searching for explorer.exe and duplicating the token of the first such process encountered, retaining the logged-in user's privileges. Alternatively, the -user <username> switch specifies the target user whose token should be duplicated. - Constructs the path to the browser application folder within the user's local application data repository. - Parses the Local State file for Chrome or Edge to gather information about stored browser user profiles. - Enumerates all profiles and scans for a field named user_name containing an email address to identify active Gmail sessions.
5. STRD technique (Shadow Token via Remote Debug): - Launches the Chromium-based browser in headless mode. - Connects via the remote debugging port to seize control of the browser. - Expits the active Gmail session (the user must not have logged out). - Sends a request to the Gmail service to grant access to Google account resources within the context of the user's saved session. - Obtains an OAuth authorization code. - Exchanges the authorization code for an OAuth 2.0 access token. - Uses the access token to reach target resources via the Google API.
6. Data access. With the OAuth access token, the attacker can read email conversations, harvest calendar data, and access other Google services via the API — all without generating traditional authentication events that EPP/EDR solutions monitor.

Technical specifics

• Target browsers: Chromium-based browsers only — specifically Google Chrome and Microsoft Edge.
• Prerequisite: The victim must have an active (non-logged-out) Gmail session in the browser.
• Malware classification: .NET DLL, ConfuserEx-obfuscated. Three versions identified (a, b, c), with varying helper functions for debugging and user-account selection.
• Persistence mechanism: Scheduled task KasperskyEndpointSecurityEDRAvp masquerading as a Kaspersky EDR component.
• Privilege escalation / token theft: Token duplication of explorer.exe process to impersonate the logged-in user.
• C2 / data exfiltration: Data access occurs via legitimate Google API calls authenticated with a stolen OAuth token — no traditional C2 channel required. This is the key evasion advantage over previous ToddyCat tooling.
• Kaspersky detection verdicts: HEUR:Trojan-PSW.MSIL.Umbrij.gen, HEUR:Trojan.MSIL.Agent.gen, HEUR:Trojan-PSW.MSIL.Agent.gen.

Confidence caveat

All technical detail in this section is single-sourced — derived solely from the Kaspersky GReAT (Securelist) report. No independent corroboration of the Umbrij tool, the STRD technique, or the specific IOCs has been identified from other vendors at time of writing. Verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

1. Hunt for the masquerade scheduled task. Search all endpoints for a scheduled task named KasperskyEndpointSecurityEDRAvp. This task name is not created by Kaspersky and is a confirmed persistence indicator. - PowerShell: Get-ScheduledTask -TaskName "KasperskyEndpointSecurityEDRAvp" -ErrorAction SilentlyContinue - If found: disable, quarantine the referenced binary, and escalate to IR.
2. Hunt for side-loading binaries. Search for the presence of the three identified legitimate binaries in unexpected locations (especially c:\Users\Public\ or c:\windows\vss\), which would indicate side-loading abuse: - BDSubWiz.exe - VSTestVideoRecorder.exe - GoogleDesktop.exe
3. Block Chromium remote debugging in production. If not already enforced, use group policy or EDR to prevent Chromium-based browsers from launching with the --remote-debugging-port flag. This is the core enabler of the STRD technique.

P2 — Within 72 hours

4. Audit OAuth token grants. Review Google Workspace admin console for recent OAuth token grants and API access. Look for tokens issued to applications that do not match your organisation's approved app inventory. Revoke any unrecognised tokens.
5. Deploy Kaspersky detection verdicts. If running Kaspersky endpoint products, confirm that the following verdicts are active and not excluded: - HEUR:Trojan-PSW.MSIL.Umbrij.gen - HEUR:Trojan.MSIL.Agent.gen - HEUR:Trojan-PSW.MSIL.Agent.gen
6. Hunt for ConfuserEx-obfuscated .NET DLLs. Use EDR or .NET assembly analysis tools to identify DLLs loaded via side-loading that exhibit ConfuserEx obfuscation signatures. Priorigate any loaded by the three named legitimate binaries.
7. Review scheduled tasks across the estate. Audit all scheduled tasks for masquerade names impersonating security vendor products. Any task name matching a security vendor product name that the vendor does not create is high-confidence malicious.

P3 — Within 7 days

8. Restrict browser profile data access. Consider restricting access to Chrome/Edge Local State and profile directories so that only the browser process and the user's own context can read them. This complicates the profile enumeration step of the attack chain.
9. Enforce Gmail session timeout. Reduce idle session timeout for corporate Gmail accounts to limit the window during which an active session can be exploited.
10. Monitor for Google API access anomalies. Configure Google Workspace alerts for unusual API access patterns — particularly API access from IP addresses or user agents that do not match normal user behaviour, and access to email/calendar resources outside normal working hours.
11. Patch / remove vulnerable binaries. If GoogleDesktop.exe is present on any endpoint, remove it — the application is discontinued and serves no legitimate purpose. Assess whether BDSubWiz.exe and VSTestVideoRecorder.exe are required on production endpoints; remove where not needed.

5. Indicators of compromise

scheduled_task_name  KasperskyEndpointSecurityEDRAvp
file_path  c:\Users\Public\BDSubWiz.exe
file_path  c:\windows\vss\bds.exe
file_name  BDSubWiz.exe
file_name  VSTestVideoRecorder.exe
file_name  GoogleDesktop.exe
file_name  Local State
detection_name  HEUR:Trojan-PSW.MSIL.Umbrij.gen
detection_name  HEUR:Trojan.MSIL.Agent.gen
detection_name  HEUR:Trojan-PSW.MSIL.Agent.gen
command_line_param  -regex
command_line_param  -deepsearch
command_line_param  -user
tool  Umbrij
obfuscator  ConfuserEx
technique  Shadow Token via Remote Debug (STRD)

6. Detection

YARA rule

rule Umbrij_ToddyCat_APT_DotNet_Sideloading {
    meta {
        author = "Adverse Trace"
        date = "2026-07-02"
        reference = "https://securelist.com/toddycat-apt-umbrij-tool-and-oauth/120251/"
        description = "Detects Umbrij malware DLL attributed to ToddyCat APT — .NET DLL obfuscated with ConfuserEx, delivered via DLL side-loading"
        tlp = "AMBER"
    }

    strings:
        $confuserex_marker1 = "ConfuserEx" ascii nocase
        $confuserex_marker2 = "Confuser" ascii nocase
        $param_regex = "-regex" ascii nocase
        $param_deepsearch = "-deepsearch" ascii nocase
        $param_user = "-user" ascii nocase
        $browser_chrome = "Chrome" ascii nocase
        $browser_edge = "Edge" ascii nocase
        $local_state = "Local State" ascii nocase
        $explorer = "explorer.exe" ascii nocase
        $user_name_field = "user_name" ascii nocase
        $sideload_binary1 = "BDSubWiz.exe" ascii nocase
        $sideload_binary2 = "VSTestVideoRecorder.exe" ascii nocase
        $sideload_binary3 = "GoogleDesktop.exe" ascii nocase
        $kaspersky_masq = "KasperskyEndpointSecurityEDRAvp" ascii nocase

    condition:
        uint16(0) == 0x5A4D and
        (
            ($confuserex_marker1 or $confuserex_marker2) and
            (3 of ($param_regex, $param_deepsearch, $param_user, $browser_chrome, $browser_edge, $local_state, $explorer, $user_name_field))
        )
}

Sigma rule

title: ToddyCat Umbrij Scheduled Task Masquerade
id: AT-2026-07-02-224-001
status: experimental
description: Detects creation of a scheduled task named KasperskyEndpointSecurityEDRAvp, which is used by ToddyCat APT to masquerade Umbrij malware persistence as a legitimate Kaspersky process.
references:

  - https://securelist.com/toddycat-apt-umbrij-tool-and-oauth/120251/
author: Adverse Trace
date: 2026/07/02
tags:

  - attack.persistence
  - attack.t1053
  - attack.defense_evasion
  - attack.t1036
logsource:
  product: windows
  service: security
detection:
  selection_task_create:
    EventID: 4698
    TaskName: "KasperskyEndpointSecurityEDRAvp"
  condition: selection_task_create
falsepositives:

  - None known — Kaspersky does not create scheduled tasks with this name
level: high

title: ToddyCat Umbrij DLL Side-Loading via Legitimate Binary
id: AT-2026-07-02-224-002
status: experimental
description: Detects execution of legitimate binaries known to be abused by ToddyCat for DLL side-loading of the Umbrij malware, especially from non-standard paths.
references:

  - https://securelist.com/toddycat-apt-umbrij-tool-and-oauth/120251/
author: Adverse Trace
date: 2026/07/02
tags:

  - attack.execution
  - attack.t1574
  - attack.defense_evasion
logsource:
  product: windows
  category: process_creation
detection:
  selection_binary:
    Image|endswith:

      - "\BDSubWiz.exe"
      - "\VSTestVideoRecorder.exe"
      - "\GoogleDesktop.exe"
  filter_legitimate_path:
    Image|startswith:

      - "C:\Program Files\"
      - "C:\Program Files (x86)\"
  condition: selection_binary and not filter_legitimate_path
falsepositives:

  - Legitimate use of these binaries from non-standard installation paths (rare)
level: high

title: ToddyCat Umbrij Command Line Parameters
id: AT-2026-07-02-224-003
status: experimental
description: Detects command lines containing Umbrij-specific parameters (-regex, -deepsearch) observed in ToddyCat APT attacks.
references:

  - https://securelist.com/toddycat-apt-umbrij-tool-and-oauth/120251/
author: Adverse Trace
date: 2026/07/02
tags:

  - attack.execution
  - attack.t1059
logsource:
  product: windows
  category: process_creation
detection:
  selection_params:
    CommandLine|contains:

      - "-regex"
      - "-deepsearch"
  filter_legitimate:
    CommandLine|contains:

      - "c:\windows\vss\bds.exe"
  condition: selection_params
falsepositives:

  - Legitimate software using similar parameter names (verify process lineage)
level: medium

Threat actor context

ToddyCat · G1022

ToddyCat is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia.

7. Sources

• Kaspersky GReAT (Securelist) — "ToddyCat: your hidden email assistant. Part 2" — https://securelist.com/toddycat-apt-umbrij-tool-and-oauth/120251/ — published 2026-06/07 (exact date not specified in source)
• The Hacker News — "ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API" — https://thehackernews.com/2026/07/toddycat-linked-umbrij-malware-abuses.html — published 2026-07-02T13:04:13+00:00
• DataBreaches.net — "Kaspersky Lab experts have discovered a new attack vector and toolkit for compromising corporate Gmail accounts" — https://databreaches.net/2026/06/30/kaspersky-lab-experts-have-discovered-a-new-attack-vector-and-toolkit-for-compromising-corporate-gmail-accounts/ — published 2026-06-30

8. Adverse Trace position

This is a high-severity advisory for EMEA financial services clients. The STRD technique is significant because it bypasses traditional EPP/EDR detection by operating entirely within the legitimate browser process context and using the Google API with a valid OAuth token — no malware signature, no anomalous network destination, no credential brute-force. The attack requires only an active Gmail session in a Chromium-based browser, a condition met by a large proportion of corporate users. Attribution to ToddyCat (MITRE G1022) is confirmed; however, all technical detail is single-sourced from Kaspersky GReAT — no independent vendor has corroborated the Umbrij toolset or IOCs at time of writing. Adverse Trace will continue monitoring for independent corroboration and will issue a update if IOCs are confirmed or a escalation if active exploitation against EMEA financial sector targets is identified. Clients should prioritise P1 actions immediately — particularly the scheduled-task hunt and Chromium remote-debugging port restriction.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.