APT ToddyCat team gains access to internal employee communications

The ToddyCat APT group has developed new ways to gain access to corporate email communications in targeted organizations.

See also: Hackers steal customer data from JPMorgan Chase and Citi

Email remains the primary way companies handle business communications, whether through their own servers like Microsoft Exchangeor cloud services like Microsoft 365 and Gmail. Many believe that cloud services provide better protection for corporate communications. Even when attackers break into a company's network, email data remains in the cloud and appears secure.

However, the ToddyCat group has found ways to circumvent this assumption. The group has evolved its methods to gain covert access to the internal communications of employees at targeted companies. Recent attacks took place in the second half of 2024 and early 2025.

See also: Hackers replace the letter 'm' with the combination 'rn' in Microsoft

These operations show how attackers have moved from traditional methods to new approaches that allow them to evade detection. The group's latest technique uses the user's browser to steal OAuth 2.0 tokens , allowing access to corporate emails from outside the compromised network.

Security researchers at Securelist have identified these new attack methods and documented how ToddyCat has changed its approach over time. The team has created tools that operate silently in the background, stealing credentials and email data without triggering many security alerts.

See also: Chinese hackers APT31 target Russian IT companies

Researchers found that ToddyCat is constantly testing and improving its techniques in order to stay one step ahead of security teams.