As reported by The Hacker News, the China-linked threat actor ToddyCat has deployed a previously undocumented malware strain called Umbrij, purpose-built to harvest corporate email communications from Gmail accounts using legitimate Google API access — a significant evolution in the group's tradecraft.
Why This Technique Is Particularly Dangerous
What makes Umbrij operationally significant is not just what it targets, but how it accesses it. By abusing OAuth — Google's own delegated authorization framework — the malware sidesteps the most common detection tripwires defenders rely on. There are no stolen passwords traversing the wire, no brute-force login attempts in authentication logs, and no obvious credential abuse to alert a SIEM. Instead, the attacker essentially walks in through the front door carrying a key Google itself handed them.
This matters enormously for enterprise security teams. Historically, protecting email has meant securing credentials and enforcing MFA. Umbrij renders that model incomplete. Once an OAuth token is granted — whether through a malicious app consent, a compromised developer account, or a token harvested from an endpoint — the attacker has persistent, API-level access that can survive password resets and even device wipes.
Shield53 Assessment: OAuth abuse represents a maturation point for APT tradecraft. Nation-state actors have recognized that API-layer intrusions are quieter, more durable, and harder to attribute than traditional credential compromise. Umbrij is a proof point, not an anomaly.
Who Is at Risk
ToddyCat has historically targeted government entities, defense contractors, and critical infrastructure organizations across Asia and Europe. The deliberate focus on corporate Gmail deployments — Google Workspace environments in particular — broadens the potential victim pool considerably. Organizations that have migrated fully to Workspace and may have relaxed traditional on-premises email security controls should treat this as a direct threat model.
The Broader OAuth Threat Landscape
Umbrij is arriving in a threat environment where OAuth abuse is already a growing concern. The Storm-0558 campaign against Microsoft 365 in 2023 demonstrated how devastating token-based access can be at scale. What ToddyCat appears to have done is adapt that lesson to Google's ecosystem with custom tooling. We should expect other threat actors — including ransomware affiliates — to follow suit as they observe the operational effectiveness of this approach.
The intelligence value of long-term, silent access to executive and operational email threads cannot be overstated. In the hands of a nation-state actor, persistent Gmail access can yield negotiating positions, personnel rosters, vendor relationships, and strategic plans — all without a single byte of data exfiltrated in a way that triggers DLP rules tuned for bulk transfer.
Shield53 Recommendations
Immediate Actions
- Audit OAuth app permissions immediately. In Google Workspace Admin Console, review all third-party apps with Gmail API access scopes (
gmail.readonly,gmail.modify,mail.google.com). Revoke any unrecognized or unvetted grants. - Enable and review OAuth token logs. Google Workspace audit logs capture OAuth token grants and API calls. Ensure these are being ingested into your SIEM and that alerts exist for unusual API access patterns, especially outside business hours or from unfamiliar IP ranges.
- Restrict third-party app access. Use Workspace's API access controls to allowlist approved applications and block unconfigured OAuth grants. Consider requiring admin approval for any new OAuth app requesting Gmail scopes.
- Hunt for ToddyCat indicators. Reference Kaspersky's published report for Umbrij-specific IOCs and integrate them into your threat intelligence platform. Look for anomalous service account activity and unusual Gmail API call volumes.
- Review service account permissions. ToddyCat campaigns frequently leverage compromised service accounts. Ensure all service accounts follow least-privilege principles and that domain-wide delegation is strictly controlled.
Strategic Guidance
- Invest in OAuth visibility tooling — solutions like CASB platforms can provide continuous monitoring of SaaS application permissions at scale.
- Train security operations teams on API-layer intrusion detection; traditional endpoint-centric detection will miss campaigns like Umbrij entirely if OAuth tokens are acquired off-endpoint.
- Conduct a tabletop exercise simulating persistent API-level email compromise — your incident response runbooks likely need updating to cover token revocation and forensic preservation of API audit logs.
ToddyCat continues to demonstrate sophisticated operational security and a willingness to innovate at the tool level. Umbrij is a reminder that defending enterprise collaboration platforms requires security controls that match the sophistication of the platforms themselves.
