Critical 2026 AI-Enabled Attack Detection — Browser Extension Package/Manifest File Creation in Extension Profile Directories
Detects the creation of browser extension files (manifest.json, .crx, .xpi) within the default user profile directories for Google Chrome, Microsoft Edge, and Mozilla Firefox. This behavior is indicative of potential unauthorized browser extension installation, which can be used for persistence or data exfiltration.
Sigma
