Remcos RAT Process Hollowing into Default Browser Executable

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•6

Detects instances where a non-browser, non-updater process attempts to perform process injection into common browser executables (Chrome, Edge, Firefox, IE). This behavior is consistent with process hollowing techniques used by Remcos RAT, particularly observed in campaigns such as FortiBleed, to masquerade malicious activity under legitimate browser processes.