APT28 - Stealthy Microsoft Edge Execution with Data URI

Ethan Andrews@eandrews

•updated Feb 16, 2026•8•0•47

Detects Microsoft Edge launched with command-line arguments used to hide the browser window (headless mode or off-screen positioning) in conjunction with a Base64-encoded HTML data URI. This technique was observed in the APT28 "Operation MacroMaze" campaign to execute payloads stealthily.