Umbrij

The week's tradecraft converged on abusing trusted primitives — OAuth tokens, signed binaries, native auth APIs and legitimate SaaS

Five otherwise-unrelated research disclosures this week point the same direction: capable actors — from a Chinese APT to commodity BEC and ransomware crews — are increasingly operating through trusted, native mechanisms rather than dropping signatureable custom malware. For a detection-engineering audience, that is the strategic note, because it tells you where the hunt surface is moving.

OAuth tokens as the target. Kaspersky GReAT documented Umbrij, a .NET tool the ToddyCat APT uses to automate theft of Google Workspace OAuth tokens via a technique GReAT calls Shadow Token via Remote Debug (STRD) — driving Chromium's remote-debugging interface to lift live tokens (Kaspersky Securelist, 2026-06-30). Cisco Talos exposed ARToken, an EvilTokens-lineage BEC-as-a-service panel (80+ API endpoints) automating Microsoft 365 device-code phishing, Primary-Refresh-Token persistence that survives password resets, and mailbox/SharePoint exfiltration (Cisco Talos). Both defeat password-centric defences: the credential is no longer the secret worth stealing, the token is.

Signed binaries and native APIs as the execution and validation layer. Blackpoint's Avalon framework chains a signed-binary MSBuild loader with ETW/AMSI patching (in-process telemetry tampering) and the CrownX ransomware payload (Blackpoint Cyber); Jamf's PamStealer impersonates the Maccy clipboard app and confirms a stolen macOS password through the native pam_authenticate API before exfiltrating it (Jamf Threat Labs) — using the OS's own auth path to guarantee the loot is valid.

Legitimate SaaS as C2. Mustang Panda (TA416 / HIVE0154) used Zoho WorkDrive as a dead-drop C2 channel (ZOHOMURK) against government and energy targets (Acronis TRU, 2026-06-29) — command traffic riding a trusted, hard-to-block SaaS host.

Weekly takeaway: the common defensive failure mode across all five is reliance on signatures and on the password as the crown jewel. The hunt has to move to anomalous use of the trusted mechanism — remote-debugging flags on browser processes, token issuance/reuse surviving resets, signed LOLBins loading unexpected code, ETW/AMSI tampering, native auth-API calls from non-auth processes, and server egress to consumer SaaS storage. Per-tool detail and detection concepts in § references.

Builds on: 2026-07-01/kaspersky-great-toddycat-s-umbrij-automates-gmail-workspace · 2026-07-02/cisco-talos-artoken-exposes-a-full-bec-as-a-service-toolkit · 2026-07-04/avalon-framework-msbuild-etw-loader-crownx-ransomware · 2026-07-04/pamstealer-macos-infostealer-pam-api-password-validation · 2026-06-30/mustang-panda-abuses-zoho-workdrive-as-a-dead-drop-c2-channe

Kaspersky GReAT: ToddyCat's "Umbrij" automates Gmail/Workspace OAuth-token theft via Chromium remote-debugging abuse

Kaspersky GReAT documented Umbrij, a .NET tool used by the ToddyCat APT that automates theft of Google Workspace OAuth tokens through a technique GReAT calls Shadow Token via Remote Debug (STRD) (Kaspersky Securelist, 2026-06-30). Umbrij copies the victim's existing Chromium profile (cached credentials, session cookies), relaunches the browser headless with the DevTools remote-debugging port enabled, and drives it via Puppeteer Sharp to silently replay a legitimate OAuth authorization-code flow against Google APIs — extracting the authorization code with no user interaction, then exchanging it server-side for access/refresh tokens. The requested scopes include https://mail.google.com/ and https://www.googleapis.com/auth/gmail.insert. Prerequisites are on-host code execution plus an already-authenticated Gmail/Workspace browser session; no separate phishing step. Umbrij loads via DLL search-order hijacking (T1574.001) through signed legitimate binaries — BDSubWiz.exe (a Bitdefender ConnectAgent component, loading log.dll), VSTestVideoRecorder.exe (a Visual Studio testing tool), and the discontinued GoogleDesktop.exe (loading GoogleServices.dll). Because it operates inside a standard browser-automation framework rather than touching credential stores directly, it evades detection tuned to credential-store access; Securelist maps the access-token stages to T1550.001 (Use Application Access Token) and T1134.003 (Access Token Manipulation: Make and Impersonate Token). [SINGLE-SOURCE] — Kaspersky is the sole publisher. Detection concepts: alert on Chromium/Edge launched with --remote-debugging-port (and --headless) from non-browser parents such as BDSubWiz.exe, VSTestVideoRecorder.exe or GoogleDesktop.exe; watch Workspace admin logs for OAuth token issuance to unexpected client IDs. Hardening: enforce Chrome Enterprise DeveloperToolsAvailability=Disabled where remote debugging isn't needed, and review OAuth app grants.