Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

CDP-Enable-BOF activates Chrome DevTools Protocol inside live Windows browsers for post-exploitation session access

Technical Analysis
First reported
Last updated
Happening score
H score 23
1 unique sources, 1 articles

Summary

Hide ▲

CDP-Enable-BOF now enables Chrome DevTools Protocol access inside a live Google Chrome or Microsoft Edge process on Windows, raising the risk of cookie theft and authenticated session hijacking after initial compromise. The technique works from within the existing browser process rather than through a browser vulnerability, which expands post-exploitation options for operators with code execution on the host. Defenders can hunt for process-injection behavior against chrome.exe and msedge.exe and for abnormal remote-debugging activity.

Related Happenings

Sysmon detection for Chrome and Edge process injection during CDP-enabled post-exploitation

Defensive Guidance
H score11 First: 14.08.2026 14:07 Last: 14.08.2026 14:07 Sources 1

How related: SpecterOps said defenders can look for signs of process injection targeting chrome.exe and msedge.exe using Sysmon Event IDs 8 and 10.

About this happening: A concrete Sysmon hunt for chrome.exe and msedge.exe injection now helps Windows defenders spot CDP-enabled post-exploitation before authenticated browser sessions...

Open Happening

ClickFix AmnesiaStealer distribution campaign targeting mac users

Campaign
H score22 First: 14.08.2026 13:45 Last: 14.08.2026 13:45 Sources 1

About this happening: A ClickFix campaign is distributing AmnesiaStealer to macOS users through a counterfeit GitHub "Download for macOS" page and a copy-and-paste command that launches...

Latest development: 16.08.2026 18:07

Jamf described AmnesiaStealer's stream_module and remote_stream commands, which copy a victim's Chromium profile into a hidden headless browser and open WebSocket and Chrome DevTools Protocol channels through webSocketDebuggerUrl. The operator can issue navigation and mouse commands, receive live screencasts, and export or import cookies to operate online portals inside the victim's authenticated sessions on Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium.

Open Happening

AmnesiaStealer macOS infostealer distributed via ClickFix

Malware Activity
H score16 First: 14.08.2026 13:45 Last: 14.08.2026 13:45 Sources 1

About this happening: AmnesiaStealer is a Rust-based macOS infostealer spread through a counterfeit GitHub "Download for macOS" page and ClickFix-style lure. It steals Keychain, b...

Open Happening

MsaRAT backdoor routes C2 through Chrome or Edge

Malware Activity
H score23 First: 23.07.2026 12:59 Last: 23.07.2026 12:59 Sources 1

About this happening: Chaos ransomware is using msaRAT, a Rust backdoor, to route C2 through headless Chrome or Microsoft Edge on a compromised Windows host. Cisco Talos...

Open Happening

Edgecution malicious Microsoft Edge extension backdoor activity

Malware Activity
H score23 First: 24.06.2026 23:58 Last: 24.06.2026 23:58 Sources 1

About this happening: The Edgecution malware is extending a Microsoft Edge browser foothold into host-level compromise by abusing Chrome Native Messaging and launching a Python-based back...

Open Happening

Timeline

  1. 14.08.2026 14:07 2 articles · 3d ago

    SpecterOps details CDP-Enable-BOF for live Chrome and Edge session access

    Initial Disclosure

    SpecterOps describes CDP-Enable-BOF, a post-exploitation technique that activates the Chrome DevTools Protocol inside a running Google Chrome or Microsoft Edge process on Windows so an operator with prior code execution can access cookies, saved data, and authenticated browser sessions. The technique works from inside chrome.exe or msedge.exe rather than by exploiting a browser vulnerability, and defenders are advised to watch for process injection and unexpected remote-debugging activity with Sysmon Event IDs 8 and 10.

    Show sources
    Open in new tab