ToddyCat: your hidden email assistant. Part 1

This Kaspersky report analyzes ToddyCat APT operations (mid‑2024–early‑2025) that evolved to exfiltrate corporate correspondence by: (1) using a PowerShell TomBerBil variant to copy browser data and DPAPI keys over SMB from domain hosts; (2) deploying TCSectorCopy to read locked Outlook OST files and exporting them with XstReader; and (3) dumping Microsoft 365 process memory (SharpTokenFinder/ProcDump) to capture OAuth JWT tokens. The report provides tool analyses, detection rules (audit/monitoring guidance, Sysmon/ProcDump detection), and IoCs (malicious binaries, file paths, PDB).