UNC6692 Snow Malware - AutoHotkey Spawning Headless Browser for SnowBelt Extension

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects instances where AutoHotkey scripts launch Microsoft Edge or Google Chrome in headless mode. This behavior is indicative of automated browser manipulation, often used in credential harvesting, session hijacking, or automated interaction with web-based platforms by malicious entities such as UNC6692.