Malicious Edge extension exfiltrates keyword-matched tab URLs to C2

Duo Tech@duotech

•updated Aug 5, 2026•1•0•1

Detects malicious browser extension background scripts exfiltrating browser data by identifying specific message patterns (type 0x14/20 and event 0xc8/200 containing keyword, url, and count fields) or activity associated with known malicious extension IDs and native messaging hosts.