--- title: The EDR blind spot: 3 ways browser attacks evade... description: Endpoint detection and response tools are built to flag host-level execution, but a growing share of attacks now play out entirely inside browser sessions or... canonical: https://daily.dev/posts/the-edr-blind-spot-3-ways-browser-attacks-evade-endpoint-telemetry-v11w3g13y twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The EDR blind spot: 3 ways browser attacks evade endpoint telemetry | daily.dev og:description: Endpoint detection and response tools are built to flag host-level execution, but a growing share of attacks now play out entirely inside browser sessions or... og:url: https://daily.dev/posts/the-edr-blind-spot-3-ways-browser-attacks-evade-endpoint-telemetry-v11w3g13y og:image: https://api.daily.dev/og/posts/V11w3G13Y.png og:image:alt: The EDR blind spot: 3 ways browser attacks evade endpoint telemetry og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The EDR blind spot: 3 ways browser attacks evade endpoint telemetry **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 8 min read · 0 upvotes · 0 comments ## Summary Endpoint detection and response tools are built to flag host-level execution, but a growing share of attacks now play out entirely inside browser sessions or SaaS applications, leaving no artifacts for EDR to inspect. Three examples illustrate the gap: Storm-2755's adversary-in-the-middle phishing campaign against Canadian employees that stole session cookies and OAuth tokens to access payroll systems; malicious Chromium extensions disguised as AI assistants that harvested ChatGPT and DeepSeek chat histories from roughly 900,000 installs across 20,000+ enterprise tenants; and the TerminalFix ClickFix campaign, where fake CAPTCHA prompts tricked victims into pasting and running malicious PowerShell commands. The piece, sponsored by Nord Security, argues organizations need layered controls across browser, identity/SaaS, and endpoint, and promotes NordLayer Browser as a way to add web threat protection, extension policies, and clipboard/upload restrictions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the Storm-2755 AiTM phishing attack steal Microsoft 365 sessions from Canadian employees? Storm-2755 used search engine poisoning and malicious ads to redirect victims searching for terms like 'Office 365' to an attacker-controlled Microsoft 365 login page. The adversary-in-the-middle proxy captured credentials, session cookies, and OAuth tokens in real time, then replayed the stolen session using an Axios user agent to access payroll and HR data and hide banking-change notifications. _Teams building AiTM phishing defenses can follow emerging attack techniques on daily.dev._ ### How many installs did the malicious AI assistant Chrome extensions get before Microsoft caught them harvesting ChatGPT chat histories? The malicious Chromium extensions disguised as AI assistants were installed about 900,000 times, with confirmed activity across more than 20,000 enterprise tenants. They collected visited URLs and content from ChatGPT and DeepSeek conversations and periodically exfiltrated this data to attacker-controlled infrastructure, reported by Microsoft in March 2026. _Developers vetting browser extensions for security risk can track incidents like this on daily.dev._ ### What is the TerminalFix ClickFix campaign and how does it trick victims into running malicious PowerShell commands? TerminalFix is a ClickFix-style campaign Microsoft observed in August 2026 where compromised websites display fake Cloudflare CAPTCHA prompts. Clicking the fake verification copies a malicious PowerShell command to the clipboard, and the page instructs the victim to paste and run it in Windows Terminal or PowerShell, leading to ZIP extraction, DLL side-loading, persistence, and a reverse tunnel. _Security engineers studying clipboard-hijacking attacks can follow campaigns like this one on daily.dev._ ## Similar posts on daily.dev - [The Endpoint Has Moved to the Browser — Your Security Tools Haven’t](https://daily.dev/posts/the-endpoint-has-moved-to-the-browser-your-security-tools-haven-t-tfa0tbcov) · Security Boulevard · 0 upvotes · 0 comments - [What 2026 DBIR Confirms: Attacks Are Living in the Browser](https://daily.dev/posts/what-2026-dbir-confirms-attacks-are-living-in-the-browser-jxtfvfa6r) · BleepingComputer · 0 upvotes · 0 comments - [Essential Data Sources for Detection Beyond the Endpoint](https://daily.dev/posts/essential-data-sources-for-detection-beyond-the-endpoint-p1jtpqr3v) · Unit 42 · 0 upvotes · 0 comments - [New Browser Security Report Reveals Emerging Threats for Enterprises](https://daily.dev/posts/new-browser-security-report-reveals-emerging-threats-for-enterprises-0onigirah) · The Hacker News · 0 upvotes · 0 comments - [The Browser Defense Playbook: Stopping the Attacks That Start on Your Screen](https://daily.dev/posts/the-browser-defense-playbook-stopping-the-attacks-that-start-on-your-screen-gthgmmpg7) · Unit 42 · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware), [#phishing](https://daily.dev/tags/phishing), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/the-edr-blind-spot-3-ways-browser-attacks-evade-endpoint-telemetry-v11w3g13y) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The EDR blind spot: 3 ways browser attacks evade endpoint telemetry","url":"https://daily.dev/posts/the-edr-blind-spot-3-ways-browser-attacks-evade-endpoint-telemetry-v11w3g13y","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-edr-blind-spot-3-ways-browser-attacks-evade-endpoint-telemetry-v11w3g13y"},"datePublished":"2026-10-02T14:12:07.967Z","dateModified":"2026-10-02T14:12:30.865Z","description":"Endpoint detection and response tools are built to flag host-level execution, but a growing share of attacks now play out entirely inside browser sessions or...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/75ea360bb8fd6b85a20080c7024b6d1b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/75ea360bb8fd6b85a20080c7024b6d1b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-edr-blind-spot-3-ways-browser-attacks-evade-endpoint-telemetry-v11w3g13y","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,malware,phishing,oauth","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"The EDR blind spot: 3 ways browser attacks evade endpoint telemetry"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-edr-blind-spot-3-ways-browser-attacks-evade-endpoint-telemetry-v11w3g13y#faq","mainEntity":[{"@type":"Question","name":"How did the Storm-2755 AiTM phishing attack steal Microsoft 365 sessions from Canadian employees?","acceptedAnswer":{"@type":"Answer","text":"Storm-2755 used search engine poisoning and malicious ads to redirect victims searching for terms like 'Office 365' to an attacker-controlled Microsoft 365 login page. The adversary-in-the-middle proxy captured credentials, session cookies, and OAuth tokens in real time, then replayed the stolen session using an Axios user agent to access payroll and HR data and hide banking-change notifications. Teams building AiTM phishing defenses can follow emerging attack techniques on daily.dev."}},{"@type":"Question","name":"How many installs did the malicious AI assistant Chrome extensions get before Microsoft caught them harvesting ChatGPT chat histories?","acceptedAnswer":{"@type":"Answer","text":"The malicious Chromium extensions disguised as AI assistants were installed about 900,000 times, with confirmed activity across more than 20,000 enterprise tenants. They collected visited URLs and content from ChatGPT and DeepSeek conversations and periodically exfiltrated this data to attacker-controlled infrastructure, reported by Microsoft in March 2026. Developers vetting browser extensions for security risk can track incidents like this on daily.dev."}},{"@type":"Question","name":"What is the TerminalFix ClickFix campaign and how does it trick victims into running malicious PowerShell commands?","acceptedAnswer":{"@type":"Answer","text":"TerminalFix is a ClickFix-style campaign Microsoft observed in August 2026 where compromised websites display fake Cloudflare CAPTCHA prompts. Clicking the fake verification copies a malicious PowerShell command to the clipboard, and the page instructs the victim to paste and run it in Windows Terminal or PowerShell, leading to ZIP extraction, DLL side-loading, persistence, and a reverse tunnel. Security engineers studying clipboard-hijacking attacks can follow campaigns like this one on daily.dev."}}]} ```