Kaspersky Details ToddyCat’s Umbrij Tool for Stealing Google OAuth Codes
Summary
Kaspersky researchers detail ToddyCat’s Umbrij tool, which sideloads through legitimate Windows apps, reuses copied Chrome and Edge profiles, and uses remote debugging to obtain Google OAuth codes for corporate Gmail API access.
Key points
- Kaspersky researchers say they identified three Umbrij versions during proactive threat hunting; a scheduled task with a name resembling a Kaspersky task was used to launch a signed file that sideloaded the malicious DLL.
- Reported sideloading hosts included BDSubWiz.exe, VSTestVideoRecorder.exe, and GoogleDesktop.exe.
- Umbrij copies browser profile data, impersonates an explorer.exe token, then launches Chrome or Edge headlessly with a remote debugging port to reuse an authenticated session.
- The tool automates Google account permission prompts and captures an OAuth authorization code, which attackers exchange for an access token to access Gmail through Google APIs.
- The researchers note that Umbrij’s authorization request omits parameters used by the legitimate applications, including PKCE and state, and requests a different set of Google service permissions.
- Recommended defenses include monitoring unusual DLL loads and browser debug launches, reviewing and revoking unused third-party Google app access, and disabling browser developer tools where appropriate. The article notes that a GUI-based approach could bypass the developer-tools restriction.
Article Details
- Attack Vectors
- ToddyCat used DLL sideloading to load Umbrij through legitimate executables including BDSubWiz.exe, VSTestVideoRecorder.exe, and GoogleDesktop.exe.
- Umbrij copied browser profile data, including active session files, then launched Chrome or Edge headlessly with a remote debugging port to operate within an authenticated user session.
- Using browser automation and JavaScript clicks, Umbrij requested OAuth permissions, captured the authorization code, and exchanged it for a token used to access Gmail resources through the Google API.
- Umbrij duplicated an explorer.exe process token to operate in the selected user's context. The article also reports a scheduled task named KasperskyEndpointSecurityEDRAvp used to launch a signed file while masquerading as legitimate activity.
- Defensive Notes
- Monitor DLL loads associated with the identified sideloading executables, especially when the DLLs load from unexpected locations.
- Alert on Chromium-based browsers launched with both --remote-debugging-port and --headless, particularly on hosts not used for development or automated testing.
- Review third-party applications with access to Google accounts; revoke access for Google Workspace Migration for Microsoft Outlook or Google Workspace Sync for Microsoft Outlook if they are not used by the organization.
- For users who do not need browser developer tools, consider disabling them through the DeveloperToolsAvailability policy. Instruct users to log out of Google accounts when sessions are no longer needed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 1ab58838e5790efb22f2d35ab98c0b7d | MD5 hash listed for a malicious Umbrij version a sample. |
| MD5 | 22aaeb4946ba6d2f2e27feb7dbb295de | MD5 hash listed for a malicious Umbrij version b sample. |
| MD5 | 3432dd9ac0df80ef86eb80bd080f839b | MD5 hash listed for a malicious Umbrij version a sample. |
| MD5 | 3d3a621f852c42d97fd7260681e42508 | MD5 hash listed for a malicious Umbrij version a sample. |
| MD5 | a7d7d6c4c3f227f7117261c63b9e23a9 | MD5 hash listed for a malicious Umbrij version a sample. |
| MD5 | f169d6d172dfb775895a5e2b1540c854 | MD5 hash listed for a malicious Umbrij version c sample. |
| MD5 | f61fbfb7aa1cd5dc8f70b055b51563e2 | MD5 hash listed for a malicious Umbrij version b sample. |
MITRE ATT&CK
T1053.005 · Scheduled TaskThe report describes a scheduled task named KasperskyEndpointSecurityEDRAvp launching a signed file as part of the activity.T1059.007 · JavaScriptUmbrij uses JavaScript to click account-selection and permission buttons in the browser.T1071.001 · Web ProtocolsUmbrij sends HTTPS requests to Google OAuth and uses the resulting token to access Gmail resources through the API.T1106 · Native APIUmbrij uses .NET functions, including GetActiveTcpConnections(), while preparing and controlling the browser-based operation.T1134.003 · Make and Impersonate TokenUmbrij searches for explorer.exe and duplicates its token to run in the selected user's context.T1219 · Remote Access ToolsUmbrij controls a headless browser through its remote debugging port to interact with the victim's authenticated session.T1574.001 · DLLAttackers used legitimate executables that insecurely load DLLs to sideload Umbrij.
Threat Actors
Malware
Vendors
BitdefenderBDSubWiz.exe: a component of the Submission Wizard in Bitdefender ConnectAgent, which is used to support connection features and interaction with other Bitdefender services or agents.GoogleToddyCat developed Umbrij to abuse Google APIs, remote debugging, and copied browser profiles to steal OAuth authorization codes from Gmail sessions while avoiding EPP and EDR detection.KasperskyTask – The malicious activity was launched through a scheduled task masquerading as a legitimate Kaspersky task (‘a scheduled task, KasperskyEndpointSecurityEDRAvp, was running on a user host’).MicrosoftThe malware targets Google Workspace Migration for Microsoft Outlook and Google Workspace Sync for Microsoft Outlook authorization flows.
Products
Bitdefender ConnectAgentBDSubWiz.exe: a component of the Submission Wizard in Bitdefender ConnectAgent, which is used to support connection features and interaction with other Bitdefender services or agents.GmailToddyCat developed Umbrij to abuse Google APIs, remote debugging, and copied browser profiles to steal OAuth authorization codes from Gmail sessions while avoiding EPP and EDR detection.Google ChromeSpecifies which browser the tool should target: Google Chrome, Microsoft Edge, or bothGoogle Desktop SearchGoogleDesktop.exe: the discontinued Google Desktop Search application for indexing files and performing quick searches on a local Windows computer.Google WorkspaceThe tool relies on DLL sideloading, token impersonation, and headless Chromium automation to compromise corporate email access through legitimate Google Workspace applications.Google Workspace Migration for Microsoft OutlookThe malware targets Google Workspace Migration for Microsoft Outlook and Google Workspace Sync for Microsoft Outlook authorization flows.Google Workspace Sync for Microsoft OutlookThe malware targets Google Workspace Migration for Microsoft Outlook and Google Workspace Sync for Microsoft Outlook authorization flows.Microsoft EdgeSpecifies which browser the tool should target: Google Chrome, Microsoft Edge, or bothVisual StudioVSTestVideoRecorder.exe: a component of the video-recording tool used for testing with Visual Studio (VS Test).