StegoAd Edge Extension Dormancy then C2 Activation after Multi-Day Delay

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects the installation of a Microsoft Edge extension followed by an outbound network connection to known StegoAd C2 infrastructure after a 3-5 day dormancy period, a behavior characteristic of time-gated sandbox evasion.