Extremely suspicious behaviour by memu emulator

A Reddit post in the r/Malware subreddit highlights suspicious behavior related to the MEmu Android emulator. The post notes that a Microsoft Edge browser policy allowing local network access is installed and linked to a domain owned by MEmu's parent company, Shanghai Maiwei Software Technology Co. , Ltd. The concern is why this policy is present, as it permits sites to make network requests to local devices and endpoints. No direct evidence of exploitation or malware is provided, and no official vendor advisory or patch information is available.

• docs.microsoft.com/DeployEdge/microsoft-edge-policies (opens in a new tab)
• reddit.com/r/Malware/comments/1twlh1r/extremely_suspicious_behaviour_by_memu_emulator/ (opens in a new tab)
• preview.redd.it/3w81xdxk595h1.png?width=813&format=png&auto=webp&s=547d5b492c4e3773b9c6cecafa60674d990bf788 (opens in a new tab)
• preview.redd.it/idda7j2s595h1.png?width=1874&format=png&auto=webp&s=83af1baf40d91fcfdfbe59c29f2b30554fe7c451 (opens in a new tab)

• Tracking AI adoption in North Korean threat actor tradecraftThreat Actor2026-10-29
• Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkNews2026-10-29
• NIK C2: The new AI-enabled command-and-control frameworkMalware2026-10-29
• Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th)Analysis2026-10-29
• Open-source tool for unpacking stripped Android native (.so) malware: static RegisterNatives recovery, ARM64 OLLVM (BR X8) deobfuscation, and Dobby anti-Frida tracingTool2026-10-28