GCP ToogleBox Recall Oauth App Authorized
Detects when a user authorizes the 'ToogleBox Recall' Google Workspace add-on. This tool has been observed being used by threat actors like UNC6661 (associated with ShinyHunters) to automate the deletion of MFA enrollment notifications, hiding unauthorized device registrations.
YARA-L
