Proxy Execution with Microsoft Edge WebView2 - Matthew Eidelberg

How do sideloading techniques work in today’s runtime environment? Join us for a free one-hour BHIS webcast with Matthew Eidelberg on proxy execution via Microsoft Edge WebView2. Matthew will break down techniques that blur the line between legitimate app behavior and malicious activity, showing how shared runtime components are changing execution and detection boundaries. You’ll learn how traditional sideloading concepts apply in modern environments, how WebView2 is increasingly embedded across the ecosystem, and how attackers can exploit it to bypass common detection methods. 🛝 Webcast Slides https://www.blackhillsinfosec.com/wp-content/uploads/2026/04/Proxy-Execution-with-Microsoft-Edge-Webview2.pdf Chapters (00:00) - Intro - Proxy Execution with Microsoft Edge WebView2 - Matthew Eidelberg (00:49) - Agenda (01:31) - DLL Hijacking (04:48) - DLL Proxy Attacks (06:05) - Execution Flow (07:17) - Windows Apps (12:05) - What is WebView2? (13:21) - Webview Security Issue (16:42) - Domain_action.dll (20:01) - Weaponizing the Flaw (22:38) - Tooling - FaceDancer (24:11) - FaceDancer - Usage (25:32) - FaceDancer - Examples (27:06) - FaceDancer - Common Questions (30:00) - FaceDancer - Caveats (30:44) - Microsoft's Response Timeline (34:04) - Microsoft's Disclosure Process (36:29) - Defensive View (38:37) - Wrap Up (39:49) - Q&A Creators & Guests Ryan Poirier - Producer Ashley Knowles - Guest Matthew Eidelberg - Guest Tom Smith - Guest Chat with your fellow attendees in the BHIS Discord server: https://discord.gg/bhis in the #🔴live-event-chat channel 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits – https://poweredbybhis.com Click here to watch a video of this episode. Brought to you by: Black Hills Information Security  https://www.blackhillsinfosec.com ☯️ Introducing BHIS Fusion Penetration Testing https://www.blackhillsinfosec.com/fusion-penetration-testing/ Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com Click here to view the episode transcript.