Firefox SmartWindow Private Browsing URL Exfiltration (smart_window Campaign)

Ethan Andrews@eandrews

•updated Jun 28, 2026•1•0•6

Detects evidence of the 'smart_window' campaign, which exploits Firefox's SmartWindow feature to exfiltrate private browsing URLs. The rule identifies suspicious outbound network requests to attacker-controlled endpoints containing specific query parameters, the creation of known PoC artifact files, and the spawning of unexpected child processes by the Firefox browser.