StegoAd Browser Extension IP Fingerprinting via Geolocation API Requests
Detects browser processes (Edge or Chrome) connecting to known IP geolocation or fingerprinting services within 3-5 days after a new extension has been registered. This behavior is consistent with malicious browser extension 'dormancy gating' and environment fingerprinting techniques, often used by malware (such as StegoAd) to confirm they are running on a real user host before activating payloads.
Microsoft Sentinel (KQL)
