ToddyCat: your hidden email assistant. Part 2

What Happened

A sophisticated hacking group called ToddyCat has built a new tool that silently steals access to your Google email and cloud files. The tool works by secretly launching your web browser in the background, using your already-logged-in Google session to request permission to read your emails, files, and contacts, and then automatically clicking the 'Allow' button without you ever seeing it. The attackers disguise the tool as legitimate software from companies like Bitdefender and Google to avoid detection by security programs. Anyone who uses Google Workspace for work email and stays logged into their Google account in their browser could be affected. This matters because the attackers gain full access to corporate email and cloud storage without needing your password. To protect yourself, you should regularly log out of your Google account when finished working, check your Google Account settings for unfamiliar app permissions, and ensure your security software is up to date.

Key Takeaways

• ToddyCat APT developed a new .NET tool called Umbrij that automates theft of Google OAuth authorization codes by launching Chromium-based browsers in headless mode with remote debugging enabled
• The technique, dubbed Shadow Token via Remote Debug (STRD), abuses legitimate Google Workspace Migration/Sync client IDs to request broad API scopes (Gmail, Drive, Calendar, Contacts, Admin Directory) without PKCE protection
• Umbrij is delivered via DLL sideloading using legitimate signed executables from Bitdefender, Visual Studio, and Google Desktop, and is obfuscated with ConfuserEx
• Attackers masquerade persistence by creating a scheduled task named KasperskyEndpointSecurityEDRAvp to impersonate legitimate security product activity
• Defenders can detect this by monitoring for browsers launched with --remote-debugging-port and --headless arguments, DLL sideloading of known vulnerable executables, and auditing Google Account third-party app connections

Affected Systems

• Windows endpoints with Chromium-based browsers (Google Chrome, Microsoft Edge) installed
• Users with active Gmail/Google Workspace sessions who have not explicitly logged out
• Organizations using Google Workspace for corporate email

Attack Chain

ToddyCat deploys Umbrij by placing a legitimate signed executable (e.g., BDSubWiz.exe, GoogleDesktop.exe, VSTestVideoRecorder.exe) alongside a malicious DLL in directories such as C:\Users\Public or C:\Windows\Temp, then triggers execution via a scheduled task named KasperskyEndpointSecurityEDRAvp. The signed executable loads the malicious DLL via sideloading; Umbrij then duplicates the explorer.exe token for user impersonation, copies the victim's Chromium browser profile files to a BackupFiles directory, and launches the browser in headless mode with a remote debugging port. Using Puppeteer Sharp, Umbrij connects to the browser's debugging port, navigates to Google's OAuth consent flow using legitimate Google Workspace Migration/Sync client IDs, and automates clicking through account selection and permission grants to capture an OAuth authorization code, which is logged and later exfiltrated for API-level access to the victim's Gmail, Drive, Calendar, and Contacts.

Detection Availability

• YARA Rules: No
• Sigma Rules: Yes
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No
• Platforms: Sigma rules (Kaspersky)

The article includes two Sigma rules: one detecting DLL hijacking of Microsoft.VisualStudio.QualityTools.VideoRecorderEngine.dll loaded from unexpected locations, and one detecting Chromium-based browsers launched with --remote-debugging-port and --headless command-line arguments. Both are authored by Kaspersky and target Windows image_load and process_creation log sources respectively.

Detection Engineering Assessment

EDR Visibility: High — The attack involves process creation, DLL loading from unexpected paths, token manipulation of explorer.exe, browser launches with unusual command-line arguments, and file copy operations — all of which are well-covered by modern EDR solutions with process telemetry and image load events. Network Visibility: Medium — The OAuth requests go to legitimate Google infrastructure (accounts.google.com, googleapis.com), making network-based detection difficult without deep inspection of request parameters like missing PKCE, modified redirect_uri, or abnormal scope combinations. The browser debugging port connection is localhost-only and not visible on the network. Detection Difficulty: Moderate — The DLL sideloading and browser launch with debug parameters are straightforward to detect with process and image load telemetry. However, the OAuth token theft itself occurs entirely within legitimate Google infrastructure using legitimate client IDs, making it difficult to distinguish from normal user activity without analyzing specific OAuth request parameters.

Required Log Sources

• Windows process creation events (Sysmon Event ID 1 or equivalent EDR process telemetry)
• Windows image load / DLL load events (Sysmon Event ID 7 or EDR module load telemetry)
• Windows scheduled task creation events (Event ID 4698)
• EDR token manipulation / impersonation telemetry
• Google Workspace Admin audit logs for OAuth token grants

Hunting Hypotheses

Control Gaps

• Network-based detection cannot identify the OAuth token theft as all requests target legitimate Google infrastructure
• Traditional email security gateways will not detect API-level email access via OAuth tokens since no login or credential submission occurs
• Application allowlisting may not flag the attack if the sideloaded legitimate executables are already approved
• Browser session monitoring tools may not capture headless browser instances launched with copied profile directories

Key Behavioral Indicators

• Chromium browser process launched with --remote-debugging-port and --headless arguments simultaneously
• DLL loads of log.dll, GoogleServices.DLL, or Microsoft.VisualStudio.QualityTools.VideoRecorderEngine.dll from C:\Windows\Temp, C:\Users\Public, or C:\Windows\Vss
• Scheduled task named KasperskyEndpointSecurityEDRAvp on systems without corresponding Kaspersky product
• explorer.exe token duplication followed by browser process creation in headless mode
• Creation of BackupFiles directories under %LOCALAPPDATA%\Google\Chrome\ or %LOCALAPPDATA%\Microsoft\Edge\
• Browser profile file copy operations (IndexedDB, Login Data, Local Storage) to non-standard directories

False Positive Assessment

• Medium — The DLL sideloading detections may trigger on legitimate use of the named executables in development or security product environments. The browser debug parameter detection will generate false positives for web developers and QA automation engineers. The OAuth token grants using GWMMO/GWSMO client IDs will be true positives only if those tools are not legitimately deployed; organizations using them will need to correlate with endpoint telemetry.

Recommendations

Immediate Mitigation

• Verify against your organization's incident response runbook and team escalation paths before acting. Consider auditing Google Account connections at https://myaccount.google.com/connections for all potentially affected users and revoking access for Google Workspace Migration for Microsoft Outlook or Google Workspace Sync for Microsoft Outlook if those tools are not deployed in your environment.
• Consider hunting your EDR or SIEM for the seven Umbrij MD5 hashes listed in the article and for the scheduled task name KasperskyEndpointSecurityEDRAvp across all endpoints.
• If your EDR supports host isolation, consider isolating any endpoints where Umbrij DLLs or the masquerading scheduled task are identified, pending further investigation.

Infrastructure Hardening

• Consider configuring the DeveloperToolsAvailability Chrome policy to 0x00000002 under HKLM\Software\Policies\Google\Chrome\DeveloperToolsAvailability for users who do not require web development tools, which disrupts the automated OAuth code retrieval.
• Evaluate whether your organization can restrict or monitor OAuth token grants for Google Workspace Migration/Sync client IDs via Google Workspace Admin Console application controls.
• Consider deploying the Sigma rules referenced in the article to your SIEM or EDR for DLL sideloading detection and browser debug parameter detection, if your tooling supports Sigma import.
• If applicable, consider disabling or restricting the Chromium remote debugging protocol via group policy for non-developer user populations.

User Protection

• Consider instructing users to explicitly log out of their Google accounts in browser sessions when work is complete, as the attack relies on maintaining an active authenticated session.
• Evaluate whether browser session isolation or separate browser profiles for corporate Google Workspace access could reduce the attack surface.
• If supported by your endpoint tooling, consider alerting on any browser process launched with --remote-debugging-port on non-developer workstations.

Security Awareness

• Consider incorporating guidance into existing security awareness programs about the importance of logging out of cloud email sessions rather than just closing the browser window.
• If applicable to your organization, consider educating users about reviewing their Google Account third-party app permissions periodically.
• Consider adding awareness content about how attackers can abuse legitimate-looking application names and security product names to disguise malicious activity.

MITRE ATT&CK Mapping

• T1574.001 - DLL Side-Loading
• T1053.005 - Scheduled Task/Job: Scheduled Task
• T1036 - Masquerading
• T1134.003 - Access Token Manipulation: Make and Impersonate Token
• T1528 - Steal Application Access Token
• T1218 - System Binary Proxy Execution

Additional IOCs

• File Hashes:
  • 9F5F2F0FB0A7F5AA9F16B9A7B6DAD89F (MD5) - Legitimate GoogleDesktop.exe leveraged for DLL sideloading — insecurely loads GoogleServices.DLL
  • 28CB7B261F4EB97E8A4B3B0D32F8DEF1 (MD5) - Legitimate BDSubWiz.exe (Bitdefender ConnectAgent component) leveraged for DLL sideloading — insecurely loads log.dll
  • BAE82A15D1DBFB024617B9B56A8E5F66 (MD5) - Legitimate VSTestVideoRecorder.exe (Visual Studio testing component) leveraged for DLL sideloading — insecurely loads Microsoft.VisualStudio.QualityTools.VideoRecorderEngine.dll
• File Paths:
  • C:\Users\Public\BDS.exe - Attacker-dropped copy of BDSubWiz.exe used as DLL sideloading host for Umbrij
  • C:\Users\Public\log.dll - Attacker-dropped malicious DLL (Umbrij) loaded via DLL sideloading by BDS.exe
  • C:\Windows\Temp\BDS.exe - Attacker-dropped copy of BDSubWiz.exe in Windows Temp for DLL sideloading
  • C:\Windows\Temp\log.dll - Attacker-dropped malicious DLL (Umbrij) in Windows Temp loaded via DLL sideloading
  • C:\Windows\Vss\bds.exe - Attacker-dropped copy of BDSubWiz.exe in Volume Shadow Copy directory for DLL sideloading
  • C:\Windows\Vss\log.dll - Attacker-dropped malicious DLL (Umbrij) in Vss directory loaded via DLL sideloading
  • C:\Windows\Temp\GoogleDesktop.exe - Attacker-dropped GoogleDesktop.exe in Windows Temp used as DLL sideloading host
  • C:\Windows\Temp\GoogleServices.DLL - Attacker-dropped malicious DLL (Umbrij) loaded via GoogleDesktop.exe sideloading
  • C:\Windows\Temp\VSTestVideoRecorder.exe - Attacker-dropped Visual Studio test recorder in Windows Temp used as DLL sideloading host
  • C:\Windows\Temp\Microsoft.VisualStudio.QualityTools.VideoRecorderEngine.dll - Attacker-dropped malicious DLL (Umbrij) loaded via VSTestVideoRecorder.exe sideloading
• Command Lines:
  • Purpose: Executing Umbrij via DLL sideloading with target user selection and deep search parameters | Tools: BDSubWiz.exe, log.dll | Stage: Initial execution / DLL sideloading | "c:\Users\Public\BDSubWiz.exe" -regex <name> -deepsearch
  • Purpose: Launching Chromium-based browser in headless mode with remote debugging port to automate OAuth token theft | Tools: chrome.exe, msedge.exe | Stage: OAuth authorization code acquisition
• Other:
  • KasperskyEndpointSecurityEDRAvp - Malicious scheduled task name created by attackers to masquerade as legitimate Kaspersky security product activity and launch Umbrij via DLL sideloading