The EDR blind spot: 3 ways browser attacks evade endpoint telemetry
NordLayer argues browser-based SaaS attacks, including AiTM phishing and malicious extensions, often evade traditional EDR.
A NordLayer product essay argues endpoint detection often misses attacks that stay inside browser and SaaS sessions. It cites UNC6395’s 2025 Salesloft Drift OAuth-token abuse against customer Salesforce environments, Microsoft-tracked Storm-2755 adversary-in-the-middle phishing of Canadian employees in 2026, and malicious Chromium extensions installed about 900,000 times across more than 20,000 enterprise tenants. The piece promotes NordLayer Browser controls for web access, extensions, file transfers, and clipboard actions.
34