ToddyCat‑Linked Umbrij Malware Exploits OAuth to Hijack Gmail

What Is the ToddyCat‑Linked Umbrij Threat?

This week security researchers uncovered a new variant of the Umbrij malware that is being deployed by the ToddyCat APT group. While Umbrij is not entirely novel, its recent evolution includes a sophisticated abuse of OAuth 2.0 to gain persistent access to Google services, especially Gmail. The attackers create forged consent grants that appear legitimate to end users, allowing them to operate under the radar of most traditional security controls.

Why OAuth Is Appealing to Attackers

OAuth is designed to simplify delegated access to cloud resources, and organizations routinely grant third‑party applications permission to read emails, calendars, or drive files. Attackers exploit this trust by registering malicious OAuth client IDs or hijacking compromised ones. Once an application secures a consent token, it can call the Google API without needing a password, bypassing many password‑based detection mechanisms. The abuse of OAuth therefore provides a stealthy persistence channel that blends with legitimate workflows.

How Umbrij Malware Exploits Google API

The Umbrij payload typically arrives via a phishing email or a compromised software update. After execution, it gathers the victim’s user context and begins a multi‑step process:

• Token Harvesting: It extracts the user’s consent screen interactions, manipulating them to approve an attacker‑controlled OAuth scope such as “mail.google.com”.
• Token Caching: The malicious module stores the retrieved access and refresh tokens locally, ensuring continued API access even after the initial consent is revoked.
• API Enumeration: Using the obtained tokens, the malware queries the Google Workspace Admin SDK and the Gmail API to enumerate mailboxes, external labels, and associated service accounts.
• Data Exfiltration: It systematically downloads messages, extracts credentials stored in email signatures, and forwards them to a command‑and‑control server.

Because the activity mimics legitimate application behavior, network monitoring tools often miss it unless they specifically inspect OAuth token usage.

Technical Breakdown: The Attack Flow

Understanding the precise sequence helps defenders identify subtle anomalies. The flow can be summarized as follows:

1. Reconnaissance: The adversary maps target users, often focusing on executives or individuals with high‑value email.
2. Phishing or Lateral Movement: Using social engineering or existing footholds, the attacker delivers the Umbrij dropper.
3. OAuth Consent Harvesting: A fabricated consent page is displayed, prompting the user to sign in with their Google account and approve the malicious scope.
4. Token Persistence: Upon approval, the attacker receives a long‑lived refresh token linked to the compromised consent.
5. API Abuse: With the token, the malware performs authorized API calls that read hidden mail attributes and write to Google Drive for staging.
6. Command & Control: Stolen data is encrypted and sent to external servers using HTTPS traffic that appears benign.

Each step introduces distinct artifacts that, when correlated, can trigger detection even if individual events seem innocuous.

Immediate Indicators of Compromise

Security teams should monitor for the following signs:

• Unusual OAuth consent grants from unknown client IDs.
• Spikes in IMAP/SMTP traffic originating from atypical source IPs.
• Unexpected refresh token creation events logged in Google Workspace admin console.
• Newly created service accounts without prior provisioning.

Actionable Defense Checklist for IT Administrators

The following checklist provides a practical, step‑by‑step approach to mitigating OAuth‑based abuse:

• Enforce Consent Restrictions: Use the Google Workspace Third‑party Application Access policy to block OAuth scopes not required for business functions.
• Implement Conditional Access: Require Multi‑Factor Authentication (MFA) for any action that leads to consent screen displays.
• Audit OAuth Apps: Regularly review the list of approved OAuth applications in the Admin console; remove any with excessive permissions.
• Monitor Token Activity: Deploy logging that records token issuance events and flags token usage from unfamiliar client IDs or geographic locations.
• Disable Unused APIs: Turn off Google APIs that are not needed (e.g., Gmail API for users who never access Gmail via third‑party apps).
• Network Segmentation: Isolate endpoints that communicate with Google services to limit lateral movement if credentials are compromised.
• Patch and Harden Clients: Ensure that mail clients and browsers are up to date to reduce the chance of malicious OAuth pop‑ups being accepted without scrutiny.