[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3SsJ_1TBu3_iMfzrAHJ5tbhWisSG-Fsg5IMvN9-brTo":3},{"article":4,"iocs":56,"watch_terms":73,"solutions":74,"lesson":164},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"1a008938-6903-4571-ad70-e2604eeb0e4d","The EDR blind spot: 3 ways browser attacks evade endpoint telemetry","the-edr-blind-spot-3-ways-browser-attacks-evade-endpoint-telemetry-f4b6d9","Browser-based attacks can steal sessions, abuse extensions, or manipulate users without creating the endpoint artifacts EDR is designed to detect. NordLayer explains three ways attacks can evade endpoint telemetry and why browser-level controls can help close the gap. [...]","Browser-based attacks, such as Adversary-in-the-Middle (AiTM) phishing and OAuth token theft, can evade traditional EDR solutions because they don't create the typical endpoint artifacts EDR is designed to detect. These attacks often occur within legitimate browser sessions, allowing threat actors to steal credentials, session cookies, and OAuth tokens to access cloud applications and sensitive data. The article highlights the need for browser-level security controls to complement EDR in SaaS-heavy environments.","Browser attacks can bypass EDR by exploiting session tokens and OAuth, evading endpoint detection.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fthe-edr-blind-spot-3-ways-browser-attacks-evade-endpoint-telemetry\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F09\u002F27\u002Fnord-radar-header.png","2026-10-02T14:00:10+00:00","2026-10-02T16:00:32.716168+00:00",8,[17,20,23,25,28,31],{"name":18,"type":19},"NordLayer Browser","product",{"name":21,"type":22},"Storm-2755","threat_actor",{"name":24,"type":22},"UNC6395",{"name":26,"type":27},"Salesloft Drift incident","campaign",{"name":29,"type":30},"EDR","technology",{"name":32,"type":30},"OAuth","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":33,"icon":35,"name":36,"slug":37},null,"Threat Intelligence","threat-intelligence",[39,44,49,54],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":55},{"id":33,"icon":35,"name":36,"slug":37},[57,60,64,67,70],{"type":58,"value":21,"context":59},"malware","Threat actor tracked by Microsoft targeting Canadian employees.",{"type":61,"value":62,"context":63},"mitre_attack","T1539","OAuth Tokens (related to Salesloft Drift incident)",{"type":61,"value":65,"context":66},"T1187","Browser Extension Exploitation (mentioned as an evasion technique)",{"type":61,"value":68,"context":69},"T1056.004","Credentials from Password Stores (related to AiTM phishing)",{"type":61,"value":71,"context":72},"T1071.001","Web Protocols (related to AiTM phishing proxy)",[18],{"controls":75,"vendors":160},[76,105,131],{"slug":77,"name":78,"problem":79,"products":80},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":106,"name":107,"problem":108,"products":109},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":127,"product_name":128,"url":129,"description":130},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":132,"name":133,"problem":134,"products":135},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[136,144,152],{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":153,"vendor_name":154,"vendor_logo":155,"product_slug":156,"product_name":157,"url":158,"description":159},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",[161],{"slug":90,"name":91,"logo_path":92,"roles":162},[163],"reported_by",{"slug":165,"title":166,"body":167,"framework_refs":168,"framework_notes":180},"browser-based-attacks-bypass-edr-by-exploiting-legitimate-sessions","Browser-Based Attacks Bypass EDR by Exploiting Legitimate Sessions","EDR tools are designed to detect malicious artifacts at the endpoint level — file writes, process injections, registry changes — but browser-based attacks like AiTM phishing and OAuth token theft operate entirely within legitimate, trusted browser sessions, leaving no traditional indicators for EDR to catch. Attackers can silently harvest session cookies and OAuth tokens, effectively bypassing multi-factor authentication and gaining persistent access to cloud and SaaS applications without ever touching the endpoint in a detectable way. This represents a critical telemetry blind spot in organizations that rely solely on EDR for threat detection. As SaaS adoption grows, the browser has become the new perimeter, and security tooling must evolve to match that reality.",[169,170,171,172,173,174,175,176,177,178,179],"CIS Control 9 – Email and Web Browser Protections","CIS Control 12 – Network Infrastructure Management","CIS Control 16 – Application Software Security","NIST SP 800-63B – Digital Identity Guidelines (Session Management)","NIST AC-17 – Remote Access","NIST SI-4 – System Monitoring","NIST IA-11 – Re-Authentication","MITRE ATT&CK T1539 – Steal Web Session Cookie","MITRE ATT&CK T1550.001 – Use Alternate Authentication Material: Application Access Token","MITRE ATT&CK T1557 – Adversary-in-the-Middle","GDPR Article 32 – Security of Processing (appropriate technical measures)",{}]