Browse public community intelligence reports, source analysis, and threat research.
14 intel reports
ToddyCat APT uses the Umbrij tool to automate OAuth token theft from Chromium-based browsers via remote debugging ports to access victim Gmail accounts.
The ToddyCat APT group utilizes Umbrij malware to compromise corporate Gmail accounts by leveraging a technique called Shadow Token via Remote Debug (STRD) to steal OAuth tokens.
The Storm-1747 threat actor uses the Tycoon 2FA AiTM phishing kit to bypass multi-factor authentication and maintain persistence in Microsoft 365 and Google Workspace environments.
Storm-1747 utilizes Tycoon 2FA to bypass MFA and maintain persistence through device registration and session token theft targeting Microsoft and Google cloud environments.
