Headless Browser with Suspicious Command Line Arguments

Bhojraj Joshi@cybrbhojrajjoshi

•updated Apr 25, 2026•3•0•155

Detects the execution of common browser executables in headless mode with command-line arguments indicative of data exfiltration, malicious rendering (dump-dom), or external requests (http/data:text/html;base64,). This activity, especially when initiated by non-standard parent processes, can be a sign of automated web scraping, vulnerability scanning, or other malicious automated browser activity.