Surf-CLI Browser Control Abuse (Instance-Resolved)

How the attack works

The agent session starts surf-cli or another tool that attaches to Chrome using --remote-debugging-port or --remote-debugging-pipe, giving it full control of the browser. Within that same session, one of two things follows: a helper process (not the browser itself) opens the browser's credential stores — Cookies, Login Data, Local State, Web Data, logins.json, or key4.db — or the session writes out a captured artifact such as a screenshot, HAR file, MHTML page, or session/cookie dump. In the second case, the same session then sends an outbound HTTP POST, PUT, or PATCH to an address outside the local machine and outside private network ranges. The detection ties all of this together by following the exact process chain spawned from the automation session, not just matching similar events anywhere on the host.

Netzilo detection

Why it matters

An attacker (or a compromised/over-permissioned agent) can extract stored passwords and session cookies, or exfiltrate a full recording of the victim's logged-in browser session, effectively taking over authenticated web accounts without needing credentials or MFA.

What you can do

• →Restrict which processes are allowed to open browser credential files (Cookies, Login Data, Local State, key4.db) outside the browser binary itself.
• →Require that any AI agent or automation tool with CDP browser control runs with a narrow, auditable permission set and logs its full process lineage.
• →Alert on artifact files (screenshots, HAR, MHTML, session/storage dumps) being created and then immediately sent to non-local, non-private-network destinations.
• →Review CI and testing pipelines that use surf-cli, Puppeteer, or Playwright and confirm any artifact uploads go only to expected, trusted endpoints.

Known benign look-alikes

• Legitimate agent-driven or CI end-to-end browser testing with surf-cli / Puppeteer / Playwright that saves a screenshot or HAR and uploads it to an artifact store — this produces the capture+egress combination and will be reported once per automation session.
• A developer manually running surf-cli against their own logged-in profile and using a helper script (node/python/cat) to inspect the cookie jar.
• Browser profile backup, migration or sync tooling launched from the same shell as the automation session inside the 15 minute window.
• Password-manager or extension test harnesses that read Login Data / key4.db while a CDP session happens to be open.
• Cookie-consent or session-replay QA tooling that exports storage_state.json and POSTs it to an internal-but-publicly-resolvable test service.

References

• https://attack.mitre.org/techniques/T1185/
• https://attack.mitre.org/techniques/T1539/
• https://attack.mitre.org/techniques/T1059/
• https://chromedevtools.github.io/devtools-protocol/
• https://www.npmjs.com/package/surf-cli

Related threats