Tag: tcsectorcopy

1 Attack Reports | 0 Vulnerabilities

Attack reports

New Tools and Techniques of ToddyCat APT

The ToddyCat APT group has evolved its methods to gain covert access to corporate email. The report details their use of PowerShell-based TomBerBil for extracting browser data, TCSectorCopy for copying Outlook OST files, and attempts to steal OAuth tokens from Microsoft 365 processes. These tools a…
apt
tomberbil
powershell
data theft
browser
oauth
outlook
2025-11-21
email
xstreader
tcsectorcopy
sharptokenfinder
Published: November 21, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports