ToddyCat Uses Shadow Token via Remote Debug to Compromise Gmail Accounts

ToddyCat, an advanced persistent threat group long associated with targeted espionage against corporate environments, has evolved its toolkit to exploit OAuth-based authorization flows and compromise Gmail accounts without directly stealing credentials. Umbrij is deployed on Windows hosts using DLL sideloading: attackers place a malicious DLL alongside legitimately signed executables known to insecurely load libraries (examples […]

The post ToddyCat Uses Shadow Token via Remote Debug to Compromise Gmail Accounts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.