Suspicious WebView2 Process Spawn by Script Interpreters or LOLBins

Ethan Andrews@eandrews

•updated Feb 18, 2026•4•0•45

Detects the Microsoft Edge WebView2 process (msedgewebview2.exe) being spawned by suspicious parent processes that typically do not use embedded web content, such as PowerShell, CMD, or common lolbins. This activity is a key indicator of the 'AI-Proxy' technique where malware uses WebView2 to programmatically interact with AI web interfaces for C2.