ToddyCat Uses Shadow Token via Remote Debug to Compromise Gmail Accounts

ToddyCat, an advanced persistent threat group long associated with targeted espionage against corporate environments, has evolved its toolkit to exploit OAuth-based authorization flows and compromise Gmail accounts without directly stealing credentials.

Umbrij is deployed on Windows hosts using DLL sideloading: attackers place a malicious DLL alongside legitimately signed executables known to insecurely load libraries (examples observed include components of Bitdefender ConnectAgent, Visual Studio test tooling, and the legacy Google Desktop).

The result is automated, stealthy theft of OAuth authorization codes and subsequent access to Gmail and other Google Workspace resources via the Google API.

Once launched, Umbrij performs a series of environment checks and prepares a copied browser profile by extracting relevant files from the victim’s Local AppData browser profile (IndexedDB, Local Storage, Network cache, Login Data, Preferences, Secure Preferences, Web Data).

If files are locked the tool uses forced-copy logic to acquire them. This copied profile is placed in a BackupFiles directory and then used to start a Chromium-based browser (Chrome or Edge) in headless mode with a specified –remote-debugging-port and –user-data-dir pointing at the copied profile.

The critical abuse chain relies on the fact that authenticated Google sessions (cookies, tokens) persist within the copied profile.

The group’s new capability, analyzed in detail by Kaspersky, leverages a .NET backdoor named Umbrij and a technique the researchers call Shadow Token via Remote Debug (STRD).

The tool crafts an authorization request that impersonates legitimate Google migration/sync clients (using client_id values tied to Google Workspace Migration for Microsoft Outlook and Google Workspace Sync for Microsoft Outlook) but strips or alters protective parameters (for example, omitting PKCE code_challenge and state parameters and simplifying redirect_uri to localhost).

 VSTestVideoRecorder.exe: a component of the video-recording tool used for testing with Visual Studio (VS Test). This executable insecurely loads a file named Microsoft.VisualStudio.QualityTools.VideoRecorderEngine.dll.

Because the browser is running the victim’s profile and is already signed in, Umbrij programmatically selects the account and clicks through the permission prompts, harvesting the authorization code embedded in the redirect URL.

ToddyCat Uses Shadow Token

That code is then exchanged for an access token, which enables API-level access to Gmail, Drive, contacts, calendars, and Directory data, allowing exfiltration of corporate correspondence and related data without triggering password-based alarms.

By connecting to the headless browser through the DevTools remote debugging interface with automation implemented via Puppeteer Sharp Umbrij drives the browser to perform the OAuth authorization flow for Google services.

Kaspersky found multiple Umbrij variants (labeled a, b, c) and observed command-line options that allow targeting specific profiles, choosing browser binaries, changing debugging ports, and saving PDFs of pages when errors occur.

The malware also duplicates explorer.exe tokens to impersonate the interactive user context, enabling access to profile folders even when multiple sessions exist on the host.

Detection and mitigation steps are straightforward but require active telemetry: monitor for suspicious DLL loads of known vulnerable executables DLL sideloading, flag Chromium launches that include –remote-debugging-port and –headless on endpoints that are not dedicated test systems, and audit process command-lines for unusual –user-data-dir usage.

Administrators should review connected third-party apps at https://myaccount.google.com/connections and immediately revoke unused GWMMO/GWSMO permissions, which would invalidate compromised tokens.

Organizations should combine EDR monitoring, browser/profile protection, application allowlists, and least-privilege controls in Google Workspace to reduce risk.

Endpoint and EDR vendors already detect Umbrij variants (Kaspersky labels include HEUR:Trojan-PSW.MSIL.Umbrij.gen and related heuristics), but defenders must tune detection for DevTools-based automation and profile theft patterns.

This STRD pattern abusing retained authenticated browser state through remote debugging to effect OAuth consent highlights a strategic shift: attackers increasingly move from credential theft to abuse of legitimate tokens and APIs.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.