ToddyCat APT Umbrij Tool Steals Cloud Email Tokens

The report documents a suspected ToddyCat APT campaign using a tool called Umbrij to steal OAuth authorization codes from Chromium-based Gmail sessions by abusing DLL sideloading and remote debugging (via Puppeteer) to run headless browsers and exchange authorization codes for access tokens, enabling full access to corporate email, Drive and contacts while evading typical security monitoring; Kaspersky and private researchers tracked multiple variants and recommend monitoring for remote debugging activity, unusual headless browser launches, OAuth application auditing, and DLL sideloading detection.