kyber.today

daily cyber × ai intelligence

← threat actors

threat actor

ToddyCat

2 stories · 1 in the wild · July 1, 2026 – July 3, 2026

evidence: 1 observed · 1 disclosed

sectors

  • finance 1 · Jul 3

malware and tools

  • umbrij 2 · Jul 3

techniques

  • collection 1 · Jul 3
  • credential access 1 · Jul 3
  • dll sideloading 1 · Jul 1
  • session hijacking 1 · Jul 1

attack phases seen

  • Credential access 2 · Jul 3
  • Collection 1 · Jul 3

what we reported, newest first, grouped by story

Jul 1 – July 3, 2026 · 2 reports

  • Kaspersky attributed new malware Umbrij to ToddyCat, using OAuth abuse to reach corporate Gmail correspondence via the Google API. The Hacker News. · Jul 3 · observed · Cloud & Identity
  • ToddyCat's new Umbrij tool hijacks Gmail sessions by DLL-sideloading a headless Chromium instance and using remote debugging to steal OAuth codes; Kaspersky flags suspicious DLL loads and Chromium launch parameters for detection. Securelist · Jul 1 · disclosed · Threat Activity