> TritonInfoSec News
Home / Jul 04, 2026 / Story
0
#9 The Hacker News general July 02, 2026 at 13:04 UTC

ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API

By [email protected] (The Hacker News)

AI Summary

Kaspersky researchers have attributed a new malware strain called Umbrij to the Chinese APT group ToddyCat, designed to abuse OAuth flows and the Google API to silently access victims' Gmail corporate email. The malware targets organizations using Google Workspace for corporate email, exfiltrating correspondence without triggering standard login alerts. Security teams should audit OAuth application grants and Google API access tokens for anomalous third-party authorizations.

Read full article → https://thehackernews.com/2026/07/toddycat-linked-…

Relevance score: 77.0/100

# More from July 04

  1. 1
    Medtronic Data Breach Impacts 3.8 Million People SecurityWeek
  2. 2
    Alleged Scattered Spider Hacker Extradited to US SecurityWeek
  3. 3
    Google, FBI Disrupt NetNut Residential Proxy Network Powered by Millions of Devices SecurityWeek
  4. 4
    FortiBleed Campaign Linked to INC, Lynx Ransomware Attacks SecurityWeek
  5. 5
    CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability SecurityWeek
  6. 6
    New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure SecurityWeek
  7. 7
    European Parliament Member Investigating Spyware Was Hacked With Pegasus The Hacker News
  8. 8
    Cisco Confirms In-the-Wild Exploitation of Unified CM Vulnerability SecurityWeek
  9. 10
    New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android The Hacker News