Chromium-based Browser Silent Execution via Command Line Flags

Tim Peck@timpeck

•updated Feb 16, 2026•1•0•41

Detects Chromium-based browsers (e.g., Microsoft Edge, Google Chrome) being launched with specific command-line arguments that attempt to hide the browser window (headless mode or positioning it off-screen). This technique was observed in the "Operation MacroMaze" campaign, attributed to APT28, where it was used to silently execute scripts and exfiltrate data using legitimate services like webhook.site.