Fake privacy browser idle-timer evasion with off-screen window injection

Arnold Chan@slaz

•updated Sep 4, 2026•0•0•1

Detects a specific evasion behavior associated with the NinjaMare malware, where a process idles for at least 7 minutes before moving its window to off-screen coordinates during automated mouse or keystroke input, followed by restoring the window to its original position.