🧰 Microsoft Edge

The items that name it 18

• Managed for Malice: How Attackers Turn MDM into Remote Access
  writeupas affected products2026-10-28It is written here as Microsoft Edge (download location for the fake installer).

  download location for the fake installer

• CikaBika Bot RAT Uses Discord for C&C
  articleas classification.technologies2026-10-15
• Patch Tuesday - October 2026
  advisoryas affected products2026-10-13It is written here as Microsoft Edge (Chromium-based; CVEs not yet listed in the Security Update Guide).

  Chromium-based; CVEs not yet listed in the Security Update Guide

• Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
  articleas classification.technologies2026-10-09
• The Closed Quorum: Inside the First Reported Autonomous AI C2 Implant
  writeupas affected products2026-09-22

  Targeted for saved browser credential theft via dumpBrowserCredentials()

• Grand Theft Auto VI hype leads to malware
  writeupas affected products2026-09-09
• Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Chrome/Windows Zero-Day Chain
  writeupas classification.technologies2026-09-09
• Patch Tuesday - September 2026
  advisoryas affected products2026-09-08It is written here as Microsoft Edge (Chromium-based).

  Chromium-based

• Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
  writeupas affected products2026-09-03

  browser download directory used to stage ScreenConnect.ClientSetup.msi in second August 20 incident

• Socket: 18 Malicious Microsoft Edge Extensions Found
  articleas classification.technologies2026-08-30
• Socket: "Superior" Campaign
  writeupas classification.technologies2026-08-28
• Popular Rust crates arrayref, append-only-vec, and internment compromised in Supply Chain Attack
  writeupas affected products2026-08-20

  Browser targeted by the infostealer for saved logins and extension storage

• Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack
  writeupas affected products2026-06-16

  Targeted alongside Chrome for credential/cookie theft using the same DPAPI/ABE-based decryption and injection approach.

• Akira, LimeWire, and the Sour Taste of Data Exfiltration
  writeupas tools2026-06-12

  Browser used by the threat actor to search Bing and access Easyupload.io

• Unpatched NTLM Leakage in Windows search: URI Handler, Same Bug, No CVE, No Fix
  writeupas affected products2026-06-02

  clicking a search: link in Edge triggers the NTLM leak with no prompt

• Botnet Fenix
  writeupas affected products2024-08-22

  browser used by the victim to download the malicious ZIP from Dropbox

• Windows explorer restrictions bypasses - filesystem access
  writeupas tools2024-04-08

  Browser used as a bypass vector to access restricted drives

• Copirate 365 at DEF CON: Plundering in the Depths of Microsoft Copilot (CVE-2026-24299) · Embrace The Red
  writeupas classification.technologies