Kaspersky Lab experts have discovered a new attack vector and toolkit for compromising corporate Gmail accounts

Kaspersky Lab has discovered Umbrij, a Windows-targeting toolkit used by the ToddyCat APT to compromise corporate Gmail accounts by connecting to Chromium browsers via the remote debug port and leveraging saved sessions to request OAuth tokens (Shadow Token via Remote Debug). The tool can gain full access to email, cloud storage, contacts and calendars without credentials, allowing prolonged, automated data harvesting; Kaspersky recommends monitoring unusual debug-port usage, auditing third-party Google app access, and disabling developer tools for non-developers.