Hackers Can Access Gmail Without Stealing Your Password. Here's How.

OAuth Gmail Access Myth Busted

A threat group called ToddyCat has shattered a common security assumption: that OAuth authentication makes Gmail accounts virtually unbreachable. Using malware named Umbrij, they've been accessing corporate Gmail accounts without stealing a single password. Instead, they exploit legitimate OAuth tokens that Google's own systems treat as authorized access.

The Details

Most people understand the basics of account security: use strong passwords, enable two-factor authentication, and watch for phishing emails. But ToddyCat's attack method bypasses all of these safeguards by targeting something different entirely.

OAuth tokens are digital permission slips that let applications access your accounts without needing your password. When you click "Sign in with Google" on a website, you're creating an OAuth token. These tokens are supposed to be secure because they're managed by Google itself, not stored on random websites.

Here's the problem: once ToddyCat's Umbrij malware infects a computer, it steals these OAuth tokens directly from the device. The malware then uses Google's official API (the legitimate tool developers use to build Gmail integrations) to access email accounts. To Google's systems, this looks completely normal. There's no failed login attempt, no suspicious password entry, and no phishing link that security training would help you spot.

Who Is Affected

This attack primarily targets professionals using corporate Gmail accounts, particularly those in organizations that might interest sophisticated threat groups. However, the technique itself works on any Gmail account that uses OAuth tokens.

Anyone who uses "Sign in with Google" for multiple services should understand this risk. If your computer becomes infected with malware, your OAuth tokens become potential targets. Home users, remote workers, and small business owners all fall into this category.

What You Should Do Right Now

1. Review your Google account's connected apps. Visit myaccount.google.com/permissions and remove access for any apps you don't actively use or recognize. Do this monthly.

The Bigger Picture

This attack reveals an uncomfortable truth: sophisticated security systems create sophisticated attack surfaces. As we move toward passwordless authentication and token-based security, criminals are adapting their methods. The weakest link is often the device itself, not the authentication system. Staying informed about these evolving threats helps families make smarter decisions about device security, app permissions, and account monitoring.

How GetCyberRight Can Help

Our Awareness Hub tracks emerging authentication threats and account takeover techniques targeting cloud services like Gmail. We translate complex attacks like ToddyCat's OAuth exploitation into clear, actionable guidance for families. When new threats emerge that affect how you protect your accounts, we break down what changed and what you need to do differently.