Cisco Talos has uncovered a sophisticated malware implant known as msaRAT that enables the Chaos ransomware group to hide its command and control communications by using a victim’s own web browser. According to Talos, the Rust based implant is deployed on compromised Windows systems before the ransomware encryption stage and avoids establishing its own outbound network connections. Instead, msaRAT communicates only with the local loopback address at 127.0.0.1 while launching Google Chrome or Microsoft Edge in headless mode. The malware then controls the browser through Chrome DevTools Protocol, which is intended for browser debugging and automation. By routing malicious communications through legitimate browser traffic, attackers significantly reduce the chances of network based security tools identifying suspicious command and control activity.
Talos explained that msaRAT first searches for installed Chrome or Edge browsers using environment variables before checking the Windows registry for Chrome if necessary. Once a supported browser is located, the malware launches it using headless mode with remote debugging enabled and creates a separate user profile for its operations. This approach allows the malware to bypass changes introduced in Chrome 136, where Google restricted remote debugging access to default user profiles after infostealers began abusing the feature for cookie theft. Rather than interacting with the victim’s personal browser profile, msaRAT operates entirely within its own temporary profile. The malware connects to Chrome DevTools Protocol through a WebSocket interface, disables Content Security Policy restrictions, registers multiple callbacks, and injects JavaScript embedded directly inside its binary. Researchers noted that callback names such as msaOpen, msaClose, msaError, and msaMessage ultimately revealed the malware’s name during the investigation.
The injected JavaScript retrieves STUN and TURN server configuration from a Cloudflare Workers endpoint while disguising network requests with Origin and Referer headers that imitate legitimate Microsoft traffic. It then establishes a WebRTC peer connection and exchanges session information through the same Cloudflare Workers infrastructure. Instead of forming a direct peer to peer connection, all communications are relayed through Twilio’s TURN service, meaning defenders monitoring network traffic only observe a browser communicating with legitimate Cloudflare and Twilio infrastructure rather than an attacker controlled server. Once the WebRTC data channel is established, the Cloudflare Worker is no longer involved in the communication path. Talos found that traffic within the data channel receives two layers of encryption. The browser secures communications using DTLS, while msaRAT adds another encryption layer using ChaCha Poly1305 and an Elliptic Curve Diffie Hellman key exchange initiated immediately after connection. The implant executes received commands through Windows Command Prompt and appears capable of reliably transferring larger payloads such as files and screenshots using built in flow control mechanisms.
According to Cisco Talos, msaRAT is delivered after attackers have already gained access to a target system and before the ransomware payload is executed. Although researchers did not determine the initial compromise method for the analyzed system, they noted that Chaos ransomware operators have previously relied on spam campaigns, voice phishing, Quick Assist, and remote management tools to establish access. The implant itself is downloaded through a single curl command disguised as a Windows update installer. A malicious MSI package loads an embedded DLL directly into memory, where the Rust based implant begins execution. Since the technique does not rely on browser vulnerabilities, Talos recommends focusing on behavioral detection rather than software patching. Security teams are advised to monitor for Chrome or Edge processes launched by installers, services, or other non interactive parent processes using headless mode together with remote debugging options, followed by unusual loopback traffic and outbound WebRTC communications. As of July 23, 2026, Talos has published only a limited set of indicators of compromise, including a staging IP address and a Cloudflare Workers hostname, while warning that these infrastructure elements can easily be replaced. The researchers emphasized that the more durable detection opportunity lies in identifying the unusual technique of a headless browser being launched and controlled by malware to conceal command and control communications.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.