New Umbrij Malware Hijacks Gmail via OAuth Attacks

Michael Miller · 2026-07-02

### The OAuth Attack on Corporate Gmail A sophisticated new malware called Umbrij is making waves in the cybersecurity world. Linked to the threat actor known as ToddyCat, this nasty piece of code is designed to quietly steal your email correspondence. And it does this by abusing something you probably use every day: OAuth. Kaspersky recently published a deep dive into this campaign. They found that attackers are laser-focused on corporate email, specifically Gmail accounts. The goal? To compromise access through APIs. It's a sneaky approach that bypasses traditional security measures. ### How Umbrij Works So, how does this malware actually get in? Here's the breakdown: - **Initial Access**: Umbrij often arrives through phishing emails or malicious downloads. Once inside, it starts gathering info. - **OAuth Abuse**: Instead of stealing passwords, it targets OAuth tokens. These tokens grant apps permission to access your Google account without needing your password. - **API Access**: With those tokens, the malware can use Google's APIs to read, send, and delete emails. It's like having a backdoor key to your inbox. This method is dangerous because it doesn't trigger typical alerts. You might not even know your email is being monitored. ### Why Corporate Email Is the Target Corporate email is a goldmine for attackers. Think about it: your work inbox contains contracts, financial data, internal communications, and maybe even passwords. ToddyCat knows this. They're not after personal accounts; they want the big fish. "In this campaign, the attackers focused their attention on corporate email communications hosted on Gmail, targeting access compromise via APIs," Kaspersky noted. This quote highlights the precision of the attack. It's not random. It's a calculated move to steal valuable business intel. ### Protecting Yourself from OAuth-Based Malware You don't have to be a sitting duck. Here are some practical steps to defend against Umbrij and similar threats: - **Review Connected Apps**: Go into your Google Account settings and check which apps have OAuth access. If you see something you don't recognize, revoke it immediately. - **Enable Two-Factor Authentication (2FA)**: This adds an extra layer of security. Even if a token is stolen, 2FA can block unauthorized access. - **Watch for Phishing**: Be cautious with unexpected emails or downloads. Umbrij often spreads through deceptive links. - **Use Antidetect Browsers**: For professionals managing multiple accounts, an antidetect browser can help mask your digital fingerprint. This makes it harder for malware to track your activity. ### The Bigger Picture This isn't just about one malware strain. It's a trend. Attackers are moving away from brute force and toward API abuse. OAuth is a powerful tool, but it's also a vulnerability if not managed properly. For businesses, this means rethinking email security. Standard antivirus might not catch Umbrij because it operates at the API level. You need advanced monitoring tools and strict access policies. ### Final Thoughts Umbrij is a wake-up call. It shows that even trusted protocols like OAuth can be weaponized. Stay vigilant, keep your software updated, and always question what apps have access to your data. Remember, cybersecurity isn't just about reacting to threats. It's about staying one step ahead. And now you know what to look for.