LeakyStealer Second Stage Execution

Georg Lauenstein@gsec

•updated Nov 9, 2025•1•1•74

Detects child processes spawned by "MicrosoftEdgeUpdateCore.exe" when it is located in the AppData directory. This behavior is characteristic of the LeakyStealer malware executing downloaded payloads or system commands as part of its post-exploitation activities.