Why EDR Misses Browser-Based Attacks in Modern Workflows
Endpoint Detection and Response (EDR) systems are designed to monitor host-level activities such as process execution, file changes, and registry modifications. However, in SaaS-heavy environments where employees rely on browser-based applications for identity workflows, file access, and admin consoles, EDR often fails to detect malicious activity that never results in host execution. According to NordLayer’s Browser Security Report 2026, browser access is present across all 504 reviewed enterprise applications, with 79% of tools available exclusively through the browser. This shift means that critical user actions — such as approving OAuth requests, uploading sensitive files, or interacting with cloud services — occur within the browser session and may not generate the endpoint artifacts EDR was built to analyze.
AiTM Phishing: Stealing Sessions Without Malware Execution
Adversary-in-the-middle (AiTM) phishing attacks exemplify how threat actors bypass EDR by intercepting authentication flows in real time. In 2026, Microsoft-tracked threat actor Storm-2755 targeted Canadian employees using search engine poisoning and malicious ads. Victims searching for terms like “Office 365” were redirected to attacker-controlled login pages that proxied the legitimate Microsoft 365 authentication process. During this flow, the attackers captured credentials, session cookies, and OAuth access tokens. Microsoft observed that the stolen session IDs were later reused from an Axios user agent, indicating token replay from attacker-controlled infrastructure.
The attackers then accessed Microsoft services, searched for payroll and HR data, created inbox rules to conceal banking-related alerts, and in some cases accessed Workday — all without installing malware or triggering process-level anomalies on the victim’s endpoint. From an EDR perspective, the authentication flow appeared legitimate, as the victim’s browser performed standard HTTPS communications. However, the session had been compromised via a transparent proxy that relayed MFA challenges and captured authenticated material. Preventing such attacks requires phishing-resistant authentication like FIDO2 WebAuthn, which ties the response cryptographically to the legitimate origin, combined with browser-level controls that block known phishing destinations and restrict access to unapproved web applications.
Malicious Extensions: Stealthy Data Exfiltration via Browser APIs
Browser extensions present another blind spot for EDR, as their code runs within browser processes and interacts with web content using standard APIs. While EDR may detect suspicious network activity or unusual browser behavior, it often lacks the context to determine which extension initiated the action, what data was accessed, or whether the extension was authorized. In March 2026, Microsoft reported on malicious Chromium extensions disguised as AI assistants that were installed approximately 900,000 times across more than 20,000 enterprise tenants. These extensions harvested visited URLs and content from ChatGPT and DeepSeek conversations, then exfiltrated the data to attacker-controlled infrastructure via HTTPS.
Despite the data theft, the host-level telemetry showed only an ordinary browser process making encrypted connections — no new processes, no suspicious executables, no file writes. Without browser-specific visibility into extension inventories, permissions, and policy enforcement, security teams cannot distinguish between legitimate and malicious extension activity. Effective mitigation requires direct control over the extension layer through allowlists, installation restrictions, and regular permission reviews for any extension capable of reading or modifying web content.
Clipboard and Web-Based Lures: Attacks That Delay Host Execution
Some browser attacks complete entirely within the web session, relying on user interaction rather than malware to achieve their goals. Techniques like ClickFix use fake verification prompts or manipulated web content to trick users into copying and executing malicious commands. In Microsoft’s August 2026 TerminalFix campaign — a ClickFix variant — compromised websites displayed fake Cloudflare CAPTCHA prompts. Clicking the prompt copied a malicious PowerShell command to the clipboard, while the page instructed users to open Windows Terminal or PowerShell and paste it.
Until the user executed the command, the attack relied solely on browser content, clipboard manipulation, and social engineering — leaving no trace in endpoint telemetry. Only after execution did PowerShell run, download and extract a ZIP archive, trigger DLL side-loading, create registry and scheduled-task persistence, initiate Active Directory discovery, and establish a reverse tunnel. At that point, EDR could detect the malicious activity. However, preventing the attack before host execution requires browser-level controls such as blocking malicious pages, restricting clipboard access, and limiting risky browser actions through web threat protection, extension policies, and browser-based DLP to stop uploads, downloads, and copy-paste transfers to unauthorized destinations.
EDR remains essential for detecting host execution, malware, persistence, and process-level behavior. But when attacks unfold inside the browser — through identity workflows, extension abuse, or clipboard manipulation — they may never generate the endpoint artifacts EDR is built to inspect.
Organizations operating in SaaS-heavy environments must adopt a layered security approach that extends beyond the endpoint. Controls need to operate at the browser identity and SaaS access layer because malicious logins, OAuth grants, extension interactions, file uploads, and clipboard actions often occur without triggering traditional endpoint defenses. While EDR remains necessary for monitoring host-based threats, browser-specific controls — including web threat protection, extension management, and session integrity enforcement — are critical for closing the visibility gap. For further insights on browser exposure and defensive strategies, refer to NordLayer’s Web-based threats report.
Source: BleepingComputer