[Beerump 2026] - Extension malveillante, zéro fichier malveillant. Normal

Last night I gave my first public talk at Beerump — a friendly rump session format where everyone gets a approximately 10 minutes to present a cybersecurity-based topic. A great first experience speaking in front of the security community. The talk was named Extension malveillante, zéro fichier malveillant.Normal.

I chose to present GAP (Ghost Anchor Persistence), the fileless persistence technique in Chromium browsers that I detailed in my previous article. The goal was to give an accessible, visual summary of the problem: browser extensions remain an underestimated attack surface, capable of persisting without leaving a classic file trace, and most EDRs aren’t looking in that direction.

The short format (a few minutes) forced me to focus on the essentials: the problem statement, the demo (an injection PoC with exfiltration to a beacon), and the impact from a defensive standpoint. For the full technical details — attack architecture, code, and a discussion of the responsible disclosure to Microsoft — check out the full article.

The slides

If the PDF doesn’t display correctly, you can open the slides directly.

Going further

For the full technical breakdown of GAP, see the article: GAP - Ghost Anchor Persistence: Fileless Extension Persistence in Chromium Browsers.

Thanks to the Beerump team for the invite and the organization — see you at the next one!