Suspicious WebView2 Usage For AI Service C2
Detects non-browser processes that spawn the WebView2 process (msedgewebview2.exe) which subsequently makes network connections to known AI platforms like copilot.microsoft.com or grok.com. This behavior is indicative of malware using an embedded browser for covert Command and Control (C2) communications, as described by Check Point Research.
Sigma
