Browser shortcut hijack co-launching CountLoader via conhost --headless

Duo Tech@duotech

•updated Aug 4, 2026•5•0•9

Detects the (currently dormant in observed samples) CountLoader capability to rewrite browser shortcuts so they co-launch conhost.exe --headless alongside a legitimate browser.