Hiding in Plain Sight: Weaponizing Developer Applications and Interpreted Languages to Evade Modern EDR

Annika Clarke

Burning River Cyber Con

November 15, 2025

SlidesEDR Evasion · Developer Tools · Offensive Security

November 15, 2025

Slide deck

View inline above or open in a new tab for your browser's PDF viewer.

View in new tab Download PDF

Speaker

Annika Clarke

Red Team Consultant & Offensive Security Engineer, Security Risk Advisors

Annika Clarke is a Red Team Consultant and Offensive Security Engineer at Security Risk Advisors. She builds offensive tooling and custom exploitation techniques for real-world engagements, with a focus on abuse of developer ecosystems and interpreter-based payloads. Annika has led numerous assessments where she combined social engineering, tooling, and creative persistence to bypass hardened endpoint defenses, and she publishes research and tooling to improve community defensive practices.

Talk overview

This talk demonstrates how trusted developer applications and interpreted languages can be weaponized to evade modern EDR. Attendees will see examples of backdoor techniques implemented via Node.js, Python, and VS Code/Electron extensions, how attackers leverage legitimate developer workflows and packaging to decrease detection surface, case studies from engagements showing escalation and persistence achieved without traditional native implants, and practical mitigations defenders can apply to reduce risk while preserving developer productivity.

Share

Share this talk with your crew or on social.

Share on X Share on Bluesky