HOOKEDGE Hidden Edge Browser Launched With Inline Data URI

Hamdani Imad@Ihamdani

•updated yesterday•1•0•42

Detects Microsoft Edge used as a hidden HTTP client by the HOOKEDGE backdoor (APT28 / Swallowtail) an inline data:text/html URL in a 1x1 or off-screen window, or a script-launched Edge with an inline data:text/html URL and --ignore-certificate-errors. In the observed intrusion HOOKEDGE was followed by hands-on-keyboard credential theft, an SSH reverse tunnel and a reflective loader (ld.exe), so a hit should be treated as a potential active compromise rather than an isolated alert.