Gmail Users at Risk: Hackers Find Hidden Path to Corporate Email

Experts from Kaspersky Lab, active in the field of cybersecurity, have identified a new attack method posing a serious threat to Gmail users, especially corporate clients. Using this method, criminals gain completely imperceptible access to the user's private correspondence, calendar, and other data in Google services. This is reported by Ixbt.com news reports.

According to experts, this attack vector, named STRD (Shadow Token via Remote Debug), is based on vulnerabilities in the OAuth authorization mechanism. Hackers use a specially developed tool called Umbrij to seize the "token" (digital key) required to enter the system. This process does not require the user to enter any login or password, making the attack extremely difficult to detect.

Attack Mechanism and Chromium Browsers

While the primary target of the attack is the Windows operating system, specialists warn that other platforms may also be at risk. The main condition is that the user must not have logged out of their account in browsers running on the Chromium engine (for example, Google Chrome or Microsoft Edge). While an active session is maintained in the browser, hackers establish a connection remotely via the debug port.

In this case, hackers launch a new instance of the browser and begin sending requests to the Gmail service on behalf of the user. As a result, the system accepts this as the action of a legitimate user. According to ixbt.com, this method allows not only reading emails but also downloading confidential data and monitoring corporate plans.

Security Measures and Recommendations

Considering that many companies and government organizations in Uzbekistan also extensively use the Google ecosystem in their work, this threat is relevant for local IT specialists as well. To ensure security in corporate networks, a number of preventive measures are recommended.

Experts advise following these security measures:

• Regularly audit third-party applications that have access to Google accounts;
• Monitor for abnormal activity in the system, specifically the launch of the browser with the debug port enabled;
• Use the Log out button to fully exit the system at the end of the workday or when using shared computers.

Currently, cybercriminals' methods are improving day by day. Therefore, controlling not only complex passwords but also the technical aspects of system access has become an integral part of modern cybersecurity. Specialists urge corporate users not to click on suspicious links and to be attentive to changes in browser settings.