STRD: The threat that steals corporate emails using headless browsers and tokens OAuth

Kaspersky has identified a new tool linked to the APT group known as ToddyCat that puts at risk the confidentiality of corporate mail in Gmail by an unorthodox vector: the capture of tokens OAuth through remote control of Chromium browsers initiated in mode headless. The technique, baptized by researchers as Shadow Token via Remote Debug (STRD), does not break passwords or exploit credentials directly; instead it takes advantage of active user sessions and the legitimate ability of Google APIs to authorize applications using OAuth 2.0.

According to signature analysis, malware called Umbrij operates on Windows and manages to run a flow that many administrators do not consider: double tokens of scanning processes to run actions with user privileges, copy browser profiles (cookies, IndexedDB, Login Data and others) to a work folder and launch Chrome or Edge with that profile in headless mode. Then use Puppeteer to connect to the remote debugging port and automate interaction with the Google authorization page, forcing the granting of permissions to an application that impersonates a legitimate migration tool (e.g., Google Workspace Migration for Microsoft Outlook). The practical result is the capture of the authorization code and its exchange by an access token with permission to read mail, Drive, contacts and calendar.

The dangerous thing about STRD is to channel seemingly harmless techniques: abuse of DLL side-loading against legitimate signed binaries, use of already authenticated browser profiles, control by DevTools protocol and automation with Puppeteer. Kaspersky documents that operators came to run Umbrij by a scheduled task that imitated security software (e.g. "KasperskyEndpointSecurityEDRAvp") and took advantage of vulnerable executables such as BDSubWiz.exe, VSTestVideoRecorder.exe or GoogleDesktop.exe to load the malicious DLL oscada with ConfuserEx.

The implications for organizations are clear: the presence of a browser session started and the possibility of launching headless instances from the team itself turn desktop equipment apparently managed into vectors for high-impact account commitments. Revocating passwords or forcing 2FA does not stop this flow if the attacker can simulate the authorization process with a browser where the session is already active. In addition, the automation that Umbrij incorporates allows the attack to scale and quickly repeat over multiple users and equipment.

At the operational level, immediate mediation measures should be taken. Users and administrators should review the approved applications in their Google accounts and revoke those that they do not recognize, in particular any entry with a similar name to Google Workspace Migration for Microsoft Outlook or Google Workspace Sync for Microsoft Outlook; that access control can be started from Google's account permissions page. Google Workspace administrators also have tools to monitor and block unapproved OAuth applications at domain level, and to invalidate tokens massively from the administrative console.

In the workstation and in the endpoints layer it is appropriate to inspect the configuration and use of remote debugging ports (e.g. 9222 or other ports opened by Chromium), to audit unusual scheduled tasks and signals from DLL side-loading or to run signed binaries that do not match the organization's policy. Early detection of copies in "% LOCALAPPDATA%\ Google\ Chrome\ BackupFiles" or "% LOCALAPPDATA%\ Microsoft\ Edge\ BackupFiles" and monitoring of headless Chromium processes controlled by Puppeteer can be commitment indicators. Also, the blocking by process implementation policy from unexpected locations and the application of lists of permitted applications reduce the abuse area.

For those who want to better understand the technical mechanisms behind the automation with browsers, the library used by the attackers is public; Puppeteer is the interface that facilitates control of Chromium instances through DevTools protocol, documentation available on their official site. In terms of OAuth access and permit management, Google maintains guidelines on how tokens work and how to revoke permissions from the user account and from the Workspace management console, which is useful for planning responses and application approval policies. Puppeteer documentation and How to manage application access to your Google account.

In a more strategic approach, organizations should combine technical controls with best practices: to limit persistent sessions in critical teams, to apply network segmentation and device management (MDM), to require that mail migration or administrative access be carried out from controlled and isolated environments, and to set up detection mechanisms in Google Workspace's business records to detect atypical tokens exchange patterns or API access. The visibility in OAuth's looms and the detection of mass permit concessions are key to identifying commitments before mass post exfiltration occurs.

Finally, Umbrij's appearance shows a trend: attackers are prioritizing the exploitation of legitimate flows (APIs, authorization protocols and migration tools) rather than just looking for classical vulnerabilities. This forces organizations to think of identity and endpoints security as a single joint front where user session protection, application governance and endpoint hygiene must be strengthened simultaneously to prevent techniques such as STRD from becoming entry doors to critical corporate communications. For those who want to read the original technical report and analysis of the APT, Kaspersky maintains his public research on his threat analysis portal. Kaspersky Securelist.