Edge new profile with generic name and near-simultaneous extension/native dirs

Duo Tech@duotech

•updated Aug 5, 2026•3•0•5

Detects creation of a new Microsoft Edge browser profile with a non-default, non-standard-numbered name, followed within 5 minutes by creation of files/folders containing "extension" or "native" under that profile's User Data path — consistent with the Edgecution malicious Edge extension backdoor installation flow.