July 3, 2026
- Kaspersky attributed new malware Umbrij to ToddyCat, using OAuth abuse to reach corporate Gmail correspondence via the Google API. The Hacker News. · Cloud & Identity
in Ransomware on Autopilot, and a Pile of Critical Bugs Under Fire
tagged
[toddycat]
2 editions · 2 items
July 1, 2026
- ToddyCat's new Umbrij tool hijacks Gmail sessions by DLL-sideloading a headless Chromium instance and using remote debugging to steal OAuth codes; Kaspersky flags suspicious DLL loads and Chromium launch parameters for detection. Securelist · Threat Activity
in CitrixBleed Returns: watchTowr Discloses a New NetScaler Pre-Auth Memory Overread