StegoAd Malicious Browser Extension Spawning Shell Processes

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•8

Detects Microsoft Edge or Google Chrome spawning suspicious shell processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe), which is characteristic of the StegoAd browser extension campaign. The rule specifically flags browser processes launching script interpreters with command-line arguments containing obfuscated content (e.g., base64, eval) or references to specific image files (e.g., loading.webp, .woff2) used for steganographic payload delivery.