Browser Profile Cloning via Robocopy Mirror and Sandbox-Disabled Chrome Relaunch

Duo Tech@duotech

•updated Jul 23, 2026•1•0•2

Detects suspicious activities associated with browser profile hijacking. It flags the use of Robocopy to mirror browser user data directories (potentially to steal session cookies) and the subsequent launch of a web browser (Chrome/Edge) with security-disabling flags such as --no-sandbox and --disable-features=RendererCodeIntegrity, which are commonly used to bypass security features and access protected browser data.