⌁ CyberSecurityBoardThreat Intel · CVEs · Products
Cyber Products

Edge Browser: Headless Mode for C2 Transport

June 29, 2026

TWINLOOT launches the victim's Edge browser in headless mode and uses CDP to ferry Graph API traffic, making it indistinguishable from legitimate activity.

Discovered from: TWINLOOT Malware Abuses SharePoint and Teams to Steal Credentials and Pivot Networks