Corporate Gmail Accounts Being Targeted by New Attack Toolkit

Kaspersky Lab experts discovered a new attack toolkit used by a hacking group called ToddyCat. This toolkit is designed to compromise corporate Gmail accounts. Once attackers gain access through an API, they can read email conversations, harvest data from calendars, and access other Google services. The attackers can remain undetected for long periods of time while collecting information. This affects people who use Gmail through their workplace, particularly if your company uses Google Workspace for business.

If you have a work email address that ends in your company name but runs on Gmail, this applies to you. Personal Gmail accounts used for home and family purposes are not the focus of this particular attack toolkit.

If you use Gmail for work, strengthen your account security immediately.

1. Enable two-factor authentication on your work Google account if you have not already done so. Ask your IT department for help if needed.
2. Review the devices and applications that have access to your work Gmail. Go to your Google account security settings and remove any unfamiliar apps or devices.
3. Watch for unusual activity like emails marked as read that you never opened, or calendar events you did not create.
4. Report any suspicious activity to your IT or security team right away. For long-term protection, make two-factor authentication standard on all your important accounts, both work and personal. Regularly review which apps and services have permission to access your email and other accounts. Remove access for anything you no longer use or do not recognize. If your employer offers security training, take it seriously. These business-focused attacks remind us that workplace security practices matter just as much as protecting our personal accounts at home.