Toddycat threat actor has been identified to use newer techniques in gaining access to corporate email information of target companies such as a home-made tool called TCSectorCopy.

This attack, according to Kaspersky, is carried out to gain tokens of the OAuth 2.0 authorization protocol which was made with the browser of the user, and can be used outside the perimeter of the compromised infrastructure to access corporate mail.

Toddycat, which is estimated to have been operational since 2020, has a record of attacking numerous companies in Europe and Asia with a multitude of tools, Samurai and TomBerBil, to stay connected and steal cookies and credentials of web browsers such as Google Chrome and Microsoft Edge.