---
id: 9436
title: "ghostsurf: From NTLM Relay to Browser Session Hijacking"
source_domain: specterops.io
source_url: "https://specterops.io/blog/2026/04/02/ghostsurf-from-ntlm-relay-to-browser-session-hijacking/"
published_at: "2026-04-02T16:00:00Z"
phying_url: "https://phying.com/item/9436"
lang: en
---

# ghostsurf: From NTLM Relay to Browser Session Hijacking

## Summary

Why ntlmrelayx's HTTP SOCKS proxy fails with browsers, how kernel-mode auth silently kills relay sessions, and a tool built to fix both.

## Intelligence Metadata

- **Sources:** specterops.io
- **Published:** 2026-04-02T16:00:00Z
- **Original:** https://specterops.io/blog/2026/04/02/ghostsurf-from-ntlm-relay-to-browser-session-hijacking/
- **Phying News:** https://phying.com/item/9436