Introduction – Browser as Primary Access Layer
Enterprises rely on browsers for SaaS logins, file sharing, and admin consoles. EDR protects against malicious executables, yet it cannot see actions that stay inside the browser. Consequently, attackers can steal OAuth tokens, upload data, or exfiltrate files without launching a new process.
Mitigation Strategies
- Integrate identity-centric telemetry such as anomalous session-ID changes, impossible login locations, or token reuse; correlating this data with endpoint logs surfaces AiTM attacks that pure process monitoring misses.
- Rotate OAuth access tokens regularly and enforce short-lived scopes for SaaS integrations; limiting token lifespan reduces the window for reuse.
- Enable clipboard and file-transfer monitoring within the browser security stack to detect data exfiltration that occurs entirely inside the browser session.
Adversary-in-the-Middle (AiTM) Phishing Attacks
Proxy Mechanics
Therefore, victims receive a legitimate-looking login page while the attacker harvests tokens in real time.
Attack Flow
- Phishing email directs the user to a look-alike login page.
- The proxy injects malicious scripts that request additional OAuth scopes.
- Stolen tokens are stored for later abuse, often without triggering EDR alerts.
Compromised Browser Extensions
Why Extensions Matter
Extensions run with the same privileges as the browser, granting them access to cookies, DOM content, and network traffic. Consequently, a single malicious add-on can harvest credentials, inject code, or exfiltrate files while remaining invisible to process-based EDR.
Detection Challenges
- Extensions do not spawn new processes.
- Activity occurs inside the browser’s memory space.
- Traditional endpoint logs lack granular extension-level events.
Browser Attacks That Occur Before Endpoint Execution
Pre-Execution Threats
- Credential-only phishing: attackers obtain valid tokens without delivering malware.
- Live-stream data exfiltration: clipboard or drag-and-drop actions move sensitive data directly to attacker-controlled sites.
Impact on EDR
Because no binary is written or executed, EDR cannot generate alerts. Therefore, organizations must supplement endpoint data with browser-level telemetry.
Layered Defense Model: Browser, Identity/SaaS, and Endpoint Controls
| Layer | Primary Controls | Key Benefits |
|---|---|---|
| Browser | • FIDO2/WebAuthn • Extension whitelisting • Web threat protection |
Blocks AiTM replay, limits malicious add-ons, filters phishing domains |
| Identity / SaaS | • Identity-centric telemetry • Short-lived OAuth tokens • Conditional access policies |
Detects impossible logins, reduces token reuse window |
| Endpoint | • Traditional EDR • Clipboard/file-transfer monitoring • Process behavior analytics |
Captures malware execution, flags data exfiltration that crosses the browser boundary |
By correlating signals across these layers, security teams can uncover attacks that would otherwise remain hidden.
** Implementing strong authentication, strict extension controls, and identity-focused telemetry creates a resilient, multi-layered defense.
In 2026, a threat actor that Microsoft tracks as Storm-2755 targeted Canadian employees through search engine poisoning and malicious ads. Victims searching for terms such as “Office 365” were redirected to a Microsoft 365 login page controlled by the attacker. The AiTM infrastructure then proxied the authentication flow in real time and captured credentials as well as session cookies and OAuth access tokens issued after successful authentication. Storm-2755 then replayed the stolen session. Microsoft observed the same session ID switch from the victim’s browser to an Axios user agent. It showed that the authentication token was being reused from an attacker-controlled infrastructure. The attackers accessed Microsoft services, searched for payroll and HR information, created inbox rules to hide messages about banking changes, and in some cases accessed Workday. The victim opens a phishing page that is between the user and the real identity provider. The page collects the username and password, relays the legitimate MFA challenge, and passes the user’s response to the real service. The attacker can then capture the authenticated session material.
Why Endpoint Telemetry Misses the Attack
From ordinary endpoint process telemetry, the authentication flow may appear legitimate. The endpoint may not reveal that an AiTM proxy has intercepted the session (although other endpoint, identity, network, or XDR signals can expose the attack). The best way to prevent many AiTM attacks is to use phishing-resistant FIDO2 WebAuthn authentication: the authentication response is cryptographically tied to the legitimate origin. Additionally, browser controls can help block known phishing destinations, restrict access to unapproved web applications, and stop the attack earlier. NordLayer Browser gives IT centralized control over areas of an attack that EDR may not see clearly: web access, browser extensions, file transfers, and clipboard actions. Web threat protection can block phishing and malicious destinations. Extension policies can allow or block specific Chrome extensions. Browser traffic can also be routed through a dedicated IP, which organizations can allowlist for SaaS access or use as a network condition in identity policies where the identity provider supports it.
Compromised Browser Extensions
Extension Behavior Without New Processes
Browser extensions create a different kind of visibility problem. They leave files in the browser profile, and their code runs inside browser processes. EDR may detect a suspicious extension or unusual network activity. However, the extension’s behavior can still look ordinary at the host level. A malicious extension can use standard browser APIs to read page content, observe URLs, interact with forms, and send data over HTTPS. None of those actions necessarily requires a new process or a suspicious executable. Without browser-specific context, a security team may see the browser traffic but not know which extension initiated it, what data it accessed, or whether the extension was approved.
Visibility Gap for EDR
A recent example: in March 2026, Microsoft reported on malicious Chromium extensions that looked like AI assistants. These extensions were installed about 900,000 times, with activity confirmed across more than 20,000 enterprise tenants. The extensions collected visited URLs and content from ChatGPT and DeepSeek conversations and periodically sent this data to an attacker-controlled infrastructure. The host can therefore show an ordinary browser process making HTTPS connections, while the security-relevant action is an extension reading and exporting page content. Endpoint tools may detect parts of the activity, but extension inventory, permissions, and policy provide the context needed to determine whether that behavior should have been allowed. Security teams should control the extension layer directly rather than waiting for a malicious domain, known malware signature, or endpoint alert. Organizations need extension allowlists, installation controls, and permission reviews for any extension that can read or modify web content.
Browser Attacks That Occur Before Endpoint Execution
Clipboard Manipulation and User Interaction
Some browser attacks complete inside the web session. A compromised website, malicious advertisement, or injected script can change rendered content, read page-accessible data, redirect the session, or manipulate the clipboard. These actions can happen within browser-granted permissions. They do not need to write files, launch malware, or create a new process. A user can also upload a sensitive file or paste confidential text into an unauthorized SaaS or AI service without any malware being installed. While that may be damaging, it does not necessarily create the artifacts EDR is built to find. For example, ClickFix attacks use fake verification prompts or other web content to persuade a victim to copy and execute a malicious command. Microsoft observed this sequence in its August 2026 TerminalFix campaign, a ClickFix variant that compromised websites and displayed fake Cloudflare CAPTCHA prompts. Clicking the fake verification step copied a malicious PowerShell command to the clipboard, while the page instructed the victim to open Windows Terminal or PowerShell and paste it. Until then, the attacker had relied on browser content, clipboard manipulation, and user interaction.
Transition to Host Execution and Telemetry Capture
Executing the command changed the telemetry: PowerShell ran, a ZIP archive was downloaded and extracted, DLL side-loading followed, registry and scheduled-task persistence were created, Active Directory discovery began, and the compromised host established a reverse tunnel. Browser controls can stop the attack before host execution by blocking the malicious page, restricting clipboard access, or limiting risky browser actions. If the user runs the copied command, the activity moves into endpoint telemetry, where EDR can inspect PowerShell execution, downloaded files, persistence, discovery, and outbound connections.
Layered Defense Model: Browser, Identity/SaaS, and Endpoint Controls
EDR alone does not cover every high-risk action in a SaaS-heavy environment. If teams expect endpoint telemetry to flag every malicious login, OAuth approval, browser upload, or extension action, they can miss activity that never becomes host execution. A SaaS-heavy environment needs controls at 3 connected layers:
- Browser – Web threat protection can block phishing and malicious sites. Extension policies can prevent unapproved code from reading web content. Browser DLP can restrict uploads, downloads, and copy-and-paste actions by destination.
- Endpoint – EDR remains needed for host execution, malware, persistence, and process-level behavior.
Browser controls are needed before data reaches an unauthorized SaaS or AI service. Once a user uploads a file, pastes confidential text, or grants excessive browser access, endpoint telemetry may not show enough context to explain or stop the action. Consequently, the browser is not just another application to monitor, but the attack surface.
Frequently Asked Questions
How do AiTM phishing attacks bypass standard endpoint detection? Standard process telemetry may show a normal authentication flow, while the session is being proxied and credentials are captured behind the scenes.
Why are compromised extensions difficult for EDR to detect? Extensions run inside existing browser processes and use standard APIs, so the host only shows ordinary HTTPS traffic without indicating which extension performed the activity.
What steps can organizations take to close the blind spot? Deploy browser-level controls such as web threat protection, extension allowlists, and DLP policies; enforce phishing-resistant authentication; and maintain robust endpoint detection for any subsequent host execution.