Umbrij Malware Lets ToddyCat Hackers Hijack Gmail Accounts Through Google API Abuse

This report details a sophisticated ToddyCat APT-style campaign that distributes a malicious MSI masquerading as Kuailian/LetsVPN to deploy an Umbrij reflective loader and a feature-rich RAT; operators achieve stealthy, long-lived access, hijack Gmail by abusing Google APIs and OAuth tokens, implement persistence and anti-EDR checks, and use numerous C2 servers. The document includes technical analysis of the loader and payload, a list of IOCs (IPs, domains, file hashes), and recommended mitigations such as restricting Google API scopes and enforcing hardware MFA.