---
title: "Discussion on \"ToddyCat and Umbrij: When OAuth Becomes the New Target of APT Campaigns\" | Hashnode"
description: "Discussion on \"ToddyCat and Umbrij: When OAuth Becomes the New Target of APT Campaigns\". Overview\nThe recent campaign recorded by the APT ToddyCat group targets businesses using the Google Workspace (Gmail) email service. By using a specialized tool called Umbrij, attackers do not try to"
url: "https://hashnode.com/posts/toddycat-and-umbrij-when-oauth-becomes-the-new-target-of-apt-campaigns/6a55a75def43fade75a858f8"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [ToddyCat and Umbrij: When OAuth Becomes the New Target of APT Campaigns](https://blog.fiscybersec.com/toddycat-and-umbrij-when-oauth-becomes-the-new-target-of-apt-campaigns?utm_source=hashnode&utm_medium=feed)

Overview The recent campaign recorded by the APT ToddyCat group targets businesses using the Google Workspace (Gmail) email service. By using a specialized tool called Umbrij, attackers do not try to

Jul 14 · 15 min read · blog.fiscybersec.com  
Read the article

-   [#toddycat](https://hashnode.com/tag/toddycat)
-   [#umbrij](https://hashnode.com/tag/umbrij)
-   [#oauth](https://hashnode.com/tag/oauth)
-   [#google-workspace](https://hashnode.com/tag/google-workspace)
-   [#mfa](https://hashnode.com/tag/mfa)
-   [#cloud-api](https://hashnode.com/tag/cloud-api)
-   [#threat-intelligence](https://hashnode.com/tag/threat-intelligence)

## Written by

[Lưu Tuấn Anh](https://hashnode.com/@anhlt120)

@anhlt120

  
[View profile](https://hashnode.com/@anhlt120)

## Responses

Markdown supported · ⌘↵ to post

No responses yet.