Evelyn Stealer - Suspicious Headless Browser Launch

Ethan Andrews@eandrews

•updated Jan 19, 2026•4•0•26

Detects browser processes launched with a specific combination of command-line flags used by Evelyn Stealer to hide its activity and bypass security. This combination includes headless mode, a disabled sandbox, and an off-screen window position.