ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API

Summary

The threat actor known as ToddyCat has been attributed to a new malware called Umbrij that's designed to gain surreptitious access to a victim's email correspondence via the Google API. "In this campaign, the attackers focused their attention on corporate email communications hosted on Gmail, targeting access compromise via APIs," Kaspersky said in a detailed report published this week. "

SpinGraph analysis pending — check back after processing.

• 19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges
• Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters
• SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
• New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos
• FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations
• AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack