Loading malware…
Umbrij is a Windows malware tool associated with the ToddyCat threat actor and used to obtain covert, durable access to Google Workspace resources by abusing OAuth 2.0 authorization from an already authenticated Chromium-based browser session. It has been used against corporate Gmail and related Google services, enabling access to email and other Workspace data through the Google API without requiring the victim’s password once authorization is completed.
Umbrij operates after an initial compromise of the victim system. It enumerates installed Chrome and Edge profiles, identifies profiles associated with signed-in Google accounts, copies browser profile data, and launches a hidden headless browser instance with remote debugging enabled. Using the DevTools protocol and Puppeteer automation, it drives a legitimate Google OAuth consent flow while impersonating trusted Google Workspace migration or synchronization applications, selects the victim’s existing signed-in account, and programmatically approves the requested permissions. It then extracts the resulting OAuth authorization code and sends or stores it for operator retrieval, after which the attackers exchange it on their own infrastructure for an access token.
This technique, referred to as Shadow Token via Remote Debug, is designed to evade protections tied to cookie theft and anomalous device detection because the authorization occurs on the victim’s actual device using the victim’s live browser session. The resulting access can persist beyond removal of the malware and may survive password resets depending on tenant configuration and token revocation practices. Observed Umbrij variants are implemented as obfuscated .NET DLLs and have been executed via DLL sideloading through legitimate signed binaries. The malware has also been observed duplicating the user context of explorer.exe to run with the victim’s privileges. Its primary purpose is stealthy post-compromise access to cloud-hosted communications and other Google Workspace resources.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The ToddyCat hackers developed a malicious tool called Umbrij to facilitate a two-step covert authorization process when the user is already authenticated in Google.
Чтобы получить этот токен, злоумышленники создали инструмент Umbrij и с его помощью подключались к консоли управления браузером в скрытом режиме (headless) через отладочный порт. Посредством нескольких запросов они получали код авторизации OAuth, который впоследствии обменивали на токен для доступа к целевым ресурсам через API.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Это возможно, например, если злоумышленники сначала получили привилегированные учетные данные администратора организации, а затем с их помощью установили вредоносное ПО на нужные машины дистанционно.
A scheduled task impersonating its software ("KasperskyEndpointSecurityEDRAvp") was used to launch a digitally signed file.
a scheduled task, KasperskyEndpointSecurityEDRAvp, was running on a user host... the attackers were attempting to masquerade their malicious activity as a legitimate process.
It then launches an instance of the browser, specifying the path to the duplicated profile via the command line.
A scheduled task impersonating its software ("KasperskyEndpointSecurityEDRAvp") was used to launch a digitally signed file.
A scheduled task impersonating its software ("KasperskyEndpointSecurityEDRAvp") was used to launch a digitally signed file.
a scheduled task, KasperskyEndpointSecurityEDRAvp, was running on a user host... the attackers were attempting to masquerade their malicious activity as a legitimate process.
Это возможно, например, если злоумышленники сначала получили привилегированные учетные данные администратора организации, а затем с их помощью установили вредоносное ПО на нужные машины дистанционно.
Сам инструмент представляет собой DLL-библиотеку, написанную на .NET и обфусцированную с помощью ConfuserEx
...для корпоративного сервиса... дело выглядит так, как будто пользователь решил подключить к своему аккаунту стороннее приложение... В качестве кода приложения... указывается одно из двух легитимных приложений: Google Workspace Migration for Microsoft Outlook (GWMMO) или Google Workspace Sync for Microsoft Outlook (GWSMO).
After that, the malware can terminate its operations and even delete itself from the system.
Это возможно, например, если злоумышленники сначала получили привилегированные учетные данные администратора организации, а затем с их помощью установили вредоносное ПО на нужные машины дистанционно.
Retrieve the user context by searching for the "explorer.exe" process and duplicating the token of the first such process it encounters in order to retain all of that logged-in user's privileges.
It searches the system for the explorer.exe process and duplicates its token, retaining all of its privileges (T1134.003 Access Token Manipulation: Make and Impersonate Token).
This technique allows the attackers to establish reliable, persistent access to a victim’s mailbox and other resources in Google Workspace.
Construct the path to the web browser application folder within the user's local application data repository and then parse the Local State file corresponding to Chrome or Edge to gather information about stored browser user profiles.
С его помощью группа автоматизировала все этапы атаки, что позволило ей оставаться незамеченной средствами мониторинга.
Umbrij copies the entire user profile folder to a different directory on the machine. It then launches an instance of the browser, specifying the path to the duplicated profile via the command line. Because this duplicate profile contains the user’s session cookies, websites with saved credentials won’t prompt for re-authentication.
Umbrij extracts and saves this code, subsequently forwarding it to the attackers’ command-and-control server.
Crucially, the browser is launched in a dedicated debugging mode typically reserved for web development... the browser can be controlled through a debugging port using the DevTools protocol, allowing the malware to issue commands and read the state of the screen. To orchestrate these actions, Umbrij leverages Puppeteer, a legitimate automation library.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malicious tool used by ToddyCat to abuse browser profiles and headless remote-debug mode to silently complete Google Workspace OAuth authorization flows, steal the resulting authorization code, and enable long-term mailbox access via OAuth tokens.
A malicious tool used by ToddyCat to covertly obtain Google Workspace OAuth authorization codes by launching Chrome or Edge with a copied user profile in headless remote-debugging mode, automating consent via DevTools/Puppeteer, and enabling persistent mailbox access through stolen OAuth tokens.
Umbrij is a .NET malware tool used by ToddyCat to compromise Gmail and broader Google account resources by abusing an active authenticated session in Chromium-based browsers. It launches Chrome or Edge in headless mode using copied user profile data, connects through a remote debugging port, obtains an OAuth authorization code, and enables operators to exchange it for an access token granting access to Gmail, Drive, Contacts, Calendar, and Tasks via Google APIs.
Инструмент APT ToddyCat для компрометации Gmail/Google account access через Chromium remote debugging. Он копирует профиль браузера жертвы, запускает Chrome/Edge в headless-режиме с remote-debugging-port, автоматизирует OAuth consent flow через Google API, извлекает OAuth authorization code и тем самым получает доступ к корпоративной почте и другим ресурсам Google через API.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.