WebView2 JavaScript Fetch and PostMessage Covert C2 Relay

Kaung Khant Ko@kaungkhantko

•updated Jul 15, 2026•0•0•2

Detects anomalous use of WebView2 browser control functionality, specifically focusing on JavaScript 'fetch' requests, 'eval' executions, and 'postMessage' communication patterns that may indicate covert Command and Control (C2) relaying or malicious browser-based exfiltration within a Windows process.