Kaspersky GReAT: ToddyCat's "Umbrij" automates Gmail/Workspace OAuth-token theft via Chromium remote-debugging abuse
Kaspersky GReAT documented Umbrij, a .NET tool used by the ToddyCat APT that automates theft of Google Workspace OAuth tokens through a technique GReAT calls Shadow Token via Remote Debug (STRD) (Kaspersky Securelist, 2026-06-30). Umbrij copies the victim's existing Chromium profile (cached credentials, session cookies), relaunches the browser headless with the DevTools remote-debugging port enabled, and drives it via Puppeteer Sharp to silently replay a legitimate OAuth authorization-code flow against Google APIs — extracting the authorization code with no user interaction, then exchanging it server-side for access/refresh tokens. The requested scopes include https://mail.google.com/ and https://www.googleapis.com/auth/gmail.insert. Prerequisites are on-host code execution plus an already-authenticated Gmail/Workspace browser session; no separate phishing step. Umbrij loads via DLL search-order hijacking (T1574.001) through signed legitimate binaries — BDSubWiz.exe (a Bitdefender ConnectAgent component, loading log.dll), VSTestVideoRecorder.exe (a Visual Studio testing tool), and the discontinued GoogleDesktop.exe (loading GoogleServices.dll). Because it operates inside a standard browser-automation framework rather than touching credential stores directly, it evades detection tuned to credential-store access; Securelist maps the access-token stages to T1550.001 (Use Application Access Token) and T1134.003 (Access Token Manipulation: Make and Impersonate Token). [SINGLE-SOURCE] — Kaspersky is the sole publisher. Detection concepts: alert on Chromium/Edge launched with --remote-debugging-port (and --headless) from non-browser parents such as BDSubWiz.exe, VSTestVideoRecorder.exe or GoogleDesktop.exe; watch Workspace admin logs for OAuth token issuance to unexpected client IDs. Hardening: enforce Chrome Enterprise DeveloperToolsAvailability=Disabled where remote debugging isn't needed, and review OAuth app grants.
ATT&CK mapping
3 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Execution TA0002
T1574.001Hijack Execution Flow: DLL
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.
Privilege Escalation TA0004
T1134.003Access Token Manipulation: Make and Impersonate Token
Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function. The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread.
Stealth TA0005
T1134.003Access Token Manipulation: Make and Impersonate Token
Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function. The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread.
T1574.001Hijack Execution Flow: DLL
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.
Lateral Movement TA0008
T1550.001Use Alternate Authentication Material: Application Access Token
Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.