⤷ Title: ToddyCat APT Steals Microsoft 365 Cloud Email by Dumping OAuth Tokens from Memory and Copying Locked OST Files
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 25 Nov 2025 00:21:05 +0000
════════════════════════
⌗ Tags: #Malware #APT #cyber_espionage #Microsoft 365 #OAuth Token Theft #Outlook OST #ProcDump #TCSectorCopy #ToddyCat
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 25 Nov 2025 00:21:05 +0000
════════════════════════
⌗ Tags: #Malware #APT #cyber_espionage #Microsoft 365 #OAuth Token Theft #Outlook OST #ProcDump #TCSectorCopy #ToddyCat
Daily CyberSecurity
ToddyCat APT Steals Microsoft 365 Cloud Email by Dumping OAuth Tokens from Memory and Copying Locked OST Files
Kaspersky exposed ToddyCat APT's evolution: the group steals M365 OAuth tokens from memory and uses TCSectorCopy to steal locked Outlook OST files, allowing covert access to cloud email outside the perimeter.