The EDR blind spot: 3 ways browser attacks evade endpoint telemetry

Summary

Browser-based attacks, such as Adversary-in-the-Middle (AiTM) phishing and OAuth token theft, can evade traditional EDR solutions because they don't create the typical endpoint artifacts EDR is designed to detect. These attacks often occur within legitimate browser sessions, allowing threat actors to steal credentials, session cookies, and OAuth tokens to access cloud applications and sensitive data. The article highlights the need for browser-level security controls to complement EDR in SaaS-heavy environments.

Full text

The EDR blind spot: 3 ways browser attacks evade endpoint telemetry Sponsored by NordLayer Browser October 2, 2026 10:00 AM 0 Article written by Andrius Buinovskis, VP of product strategy at NordLayer EDR remains necessary when attackers execute code on the host. The problem starts if teams expect EDR to flag every anomalous action, including browser-based SaaS activity that may look like a normal user session from the endpoint. In SaaS-heavy environments, an employee can authenticate to a cloud application, approve an OAuth request, open sensitive files, or upload data through a browser session. The action may never create a new attacker-controlled executable or a process that endpoint defenses would classify as malicious. Like in the 2025 Salesloft Drift incident: UNC6395 obtained OAuth tokens associated with Drift integrations and used them to make high-volume API calls against customers’ Salesforce environments. This way, authenticated SaaS access enabled data theft without a malware process for EDR to inspect. The browser has become the primary access layer for corporate SaaS applications, identity workflows, files, and admin consoles. NordLayer’s Browser Security Report 2026 found that browser access is present across the full set of 504 reviewed applications, with 79% of tools available only through the browser. That makes browser sessions a core location for user actions that may not produce the endpoint artifacts EDR was built to analyze. EDR still detects host execution, malware, persistence, and process-level behavior. But in SaaS-heavy environments, some attacks are carried out through browser and identity workflows that do not create the endpoint artifacts EDR is built to inspect. In adversary-in-the-middle phishing attacks, malicious browser extensions, unauthorized uploads, or clipboard-based execution lures, the decisive action happens inside the browser or the cloud application. Adversary-in-the-middle (AiTM) phishing In 2026, a threat actor that Microsoft tracks as Storm-2755 targeted Canadian employees through search engine poisoning and malicious ads. Victims searching for terms such as “Office 365” were redirected to a Microsoft 365 login page controlled by the attacker. The AiTM infrastructure then proxied the authentication flow in real time and captured credentials as well as session cookies and OAuth access tokens issued after successful authentication. Storm-2755 then replayed the stolen session. Microsoft observed the same session ID switch from the victim’s browser to an Axios user agent. It showed that the authentication token was being reused from an attacker-controlled infrastructure. The attackers accessed Microsoft services, searched for payroll and HR information, created inbox rules to hide messages about banking changes, and in some cases accessed Workday. The mechanics are typical of AiTM phishing. The victim opens a phishing page that is between the user and the real identity provider. The page collects the username and password, relays the legitimate MFA challenge, and passes the user’s response to the real service. The attacker can then capture the authenticated session material. From ordinary endpoint process telemetry, the authentication flow may appear legitimate. The endpoint may not reveal that an AiTM proxy has intercepted the session (although other endpoint, identity, network, or XDR signals can expose the attack). The best way to prevent many AiTM attacks is to use phishing-resistant FIDO2 WebAuthn authentication: the authentication response is cryptographically tied to the legitimate origin. On top of that, browser controls can help block known phishing destinations, restrict access to unapproved web applications, and stop the attack earlier. Add browser-level controls with the NordLayer Browser NordLayer Browser gives IT centralized control over areas of an attack that EDR may not see clearly: web access, browser extensions, file transfers, and clipboard actions. Web threat protection can block phishing and malicious destinations. Extension policies can allow or block specific Chrome extensions. Browser traffic can also be routed through a dedicated IP, which organizations can allowlist for SaaS access or use as a network condition in identity policies where the identity provider supports it. Explore NordLayer Browser Compromised browser extensions Browser extensions create a different kind of visibility problem. They leave files in the browser profile, and their code runs inside browser processes. EDR may detect a suspicious extension or unusual network activity. But the extension’s behavior can still look ordinary at the host level. A malicious extension can use standard browser APIs to read page content, observe URLs, interact with forms, and send data over HTTPS. None of those actions necessarily requires a new process or a suspicious executable. Without browser-specific context, a security team may see the browser traffic but not know which extension initiated it, what data it accessed, or whether the extension was approved. A recent example: in March 2026, Microsoft reported on malicious Chromium extensions that looked like AI assistants. These extensions were installed about 900,000 times, with activity confirmed across more than 20,000 enterprise tenants. The extensions collected visited URLs and content from ChatGPT and DeepSeek conversations and periodically sent this data to an attacker-controlled infrastructure. The host can therefore show an ordinary browser process making HTTPS connections, while the security-relevant action is an extension reading and exporting page content. Endpoint tools may detect parts of the activity, but extension inventory, permissions, and policy provide the context needed to determine whether that behavior should have been allowed. Security teams should control the extension layer directly rather than waiting for a malicious domain, known malware signature, or endpoint alert. Organizations need extension allowlists, installation controls, and permission reviews for any extension that can read or modify web content. Browser attacks before endpoint execution Some browser attacks complete inside the web session. A compromised website, malicious advertisement, or injected script can change rendered content, read page-accessible data, redirect the session, or manipulate the clipboard. These actions can happen within browser-granted permissions. They do not need to write files, launch malware, or create a new process. A user can also upload a sensitive file or paste confidential text into an unauthorized SaaS or AI service without any malware being installed. While that may be damaging, it does not necessarily create the artifacts EDR is built to find. For example, ClickFix attacks use fake verification prompts or other web content to persuade a victim to copy and execute a malicious command. Microsoft observed this sequence in its August 2026 TerminalFix campaign, a ClickFix variant that compromised websites and displayed fake Cloudflare CAPTCHA prompts. Clicking the fake verification step copied a malicious PowerShell command to the clipboard, while the page instructed the victim to open Windows Terminal or PowerShell and paste it. Until then, the attacker had relied on browser content, clipboard manipulation, and user interaction. Executing the command changed the telemetry: PowerShell ran, a ZIP archive was downloaded and extracted, DLL side-loading followed, registry and scheduled-task persistence were created, Active Directory discovery began, and the compromised host established a reverse tunnel. Browser controls can stop the attack before host execution by blocking the malicious page, restricting clipboard access, or limiting risky browser actions. If the user runs the copied command, the activity moves into endpoint telemetry, where EDR can inspect PowerShell execution, downloaded files, persistence, discovery, and outbound connections. The control should

Indicators of Compromise

• malware — Storm-2755
• mitre_attack — T1539
• mitre_attack — T1187
• mitre_attack — T1056.004
• mitre_attack — T1071.001

Entities