ToddyCat's Umbrij Malware Abuses Debugging Ports to Steal Corporate Gmail OAuth Tokens

Cybersecurity researchers have identified a new custom malware tool dubbed "Umbrij," deployed by the advanced persistent threat (APT) group known as ToddyCat. The discovery was made during a proactive threat hunting operation aimed at uncovering novel evasion techniques.[3]

The primary objective of the Umbrij malware is to compromise corporate email communications hosted on Google Workspace, specifically targeting Gmail accounts. By gaining access to these inboxes, the threat actors can monitor sensitive internal correspondence and exfiltrate proprietary data.[1]

Unlike traditional credential stealers that attempt to harvest usernames and passwords, Umbrij operates on a completely different paradigm. It abuses Google's OAuth 2.0 authorization process to silently extract access tokens, bypassing the need for traditional login credentials entirely.[2]

Claim 1: The malware bypasses Multi-Factor Authentication (MFA) by hijacking existing, authenticated sessions. Evidence strongly supports this assertion: the attack relies on the victim already being logged into their Google account within a Chromium-based browser, such as Google Chrome or Microsoft Edge.[1]

Because the session is already authenticated by the user, Google's security systems recognize the browser profile as legitimate. Consequently, the platform does not prompt the user to re-enter a password or provide a secondary MFA token, allowing the malware to operate undetected by standard identity checks.[2]

Claim 2: The attack utilizes a novel technique dubbed "Shadow Token via Remote Debug" (STRD). Kaspersky's technical analysis details how the malware launches a hidden, headless instance of the user's Chromium browser, operating entirely in the background without rendering a visible window.[3]

Once the headless browser is running, Umbrij connects to it via the remote debugging port. This built-in developer feature allows the malware to programmatically control the browser, inspect web elements, and execute commands without the user's knowledge or interaction.

To execute the automation, the attackers utilize Puppeteer Sharp, a .NET port of the popular Node.js library widely used by developers for legitimate browser automation and software testing.

Through Puppeteer Sharp, the malware navigates the headless browser to a specially crafted Google OAuth authorization page. Here, it impersonates legitimate Google Workspace applications, specifically mimicking "Google Workspace Migration for Microsoft Outlook" (GWMMO) or "Google Workspace Sync."[1][2]

Claim 3: The malware automates the consent process to grant itself access. The evidence shows that Umbrij programmatically interacts with the DOM (Document Object Model) to click the "Allow" button on the OAuth consent screen, authorizing the requested permissions instantly.[3]

These requested permissions are exceptionally broad. The malware seeks full access to the victim's Gmail, Google Drive, Calendar, Contacts, and user profile information, effectively granting the attackers total control over the user's cloud workspace.[2]

Once the consent is granted, Google issues an OAuth authorization code. Umbrij captures this code from the browser, saves it to a local log file, and subsequently exfiltrates it to the attacker's command-and-control server.[1]

The threat actors then exchange this authorization code for a persistent OAuth access token. They use this token to query the Google API directly from their own infrastructure, completely bypassing the victim's machine for all subsequent data access.[1]

Claim 4: The malware employs sophisticated obfuscation to evade endpoint detection. Researchers note that Umbrij is written in the .NET framework and heavily protected using the open-source ConfuserEx obfuscator, making reverse engineering and static analysis highly difficult for security software.[2]

Furthermore, the malware relies on DLL sideloading for its initial execution. It hides within trusted, digitally signed applications—such as Bitdefender ConnectAgent or Microsoft Visual Studio testing tools—to bypass basic security checks and execute its malicious payload under the guise of a legitimate process.[2]

Uncertainty and Limitations: While the STRD technique is highly effective, the evidence indicates it has strict prerequisites. The victim's machine must already be compromised to deploy the malware, and the user must have an active, unexpired Google session in their browser for the token extraction to succeed.[2]

If the user has explicitly logged out of their Google account, the headless browser instance will hit a standard login screen. Because the malware does not possess the user's password, the automated OAuth extraction process will fail.[3]

Defense and Mitigation: Because the attack leverages legitimate API functionality and developer tools, traditional endpoint detection and response (EDR) platforms may struggle to flag the behavior. Defenders must pivot their strategy toward identity and configuration management.[1][4]

Security teams are strongly advised to disable browser developer tools and remote debugging ports via Group Policy across the enterprise, ensuring that these features are only accessible to authorized developer roles.

Additionally, administrators should regularly audit OAuth grants within their organization. By reviewing connected applications at myaccount.google.com/connections, security teams can identify unauthorized instances of "Google Workspace Migration for Microsoft Outlook" and revoke the malicious access tokens immediately.[1][3]