We published a free CLI tool after writing about PinchTab — a browser hijacking technique that abuses Chrome DevTools Protocol to give attackers (or compromised AI agents) silent access to live browser sessions. No malware signature. No process injection. Most EDRs don't see it at all.

Unpinched is a point-in-time scanner — think nmap for PinchTab presence. Single Go binary, no install required, runs in ~3 seconds.

It checks four things: - Local ports for a PinchTab HTTP API server (with signature verification) - Running processes matching known PinchTab binary names - Unauthenticated CDP exposure on localhost:9222 - Known filesystem artifact paths across macOS, Linux, Windows

Also ships as a GitHub Action so you can gate deploys on a clean scan result.

GitHub: https://github.com/Helixar-AI/Unpinched

The underlying research on why CDP-based attacks evade conventional security stacks is here if you're curious: https://helixar.ai/press/pinchtab-stealth-browser-attacks-yo...

Happy to answer questions on the detection logic or the threat model.