ToddyCat: your hidden email assistant. Part 2

ToddyCat APT deployed a .NET tool called Umbrij that automates stealing OAuth authorization codes from signed-in Gmail sessions by copying browser profile data, launching Chromium-based browsers in headless mode via a remote debugging port, and automating account consent; execution is achieved through DLL sideloading of legitimate binaries. The report includes technical analysis, multiple Umbrij variants, IOCs (file hashes and paths), and detection/mitigation recommendations such as monitoring for suspicious DLL loads, browser debug launch arguments, and revoking unused third-party Google app access.