The Chaos ransomware-as-a-service operation, active since it was first confirmed in February 2025, has added a new trick to its post-compromise playbook: hiding its command-and-control traffic inside an ordinary-looking Chrome or Edge browser session. Cisco Talos researchers identified the Rust-based tool behind this technique, naming it msaRAT after internal code labels like msaOpen, msaClose, and msaMessage found in the malware.

From Phishing to a Fake Update

Chaos typically gains initial access through spam email and voice-phishing calls, then leans on remote-management software and legitimate file-sharing services to maintain a foothold and exfiltrate data before deploying encryption — a familiar double-extortion pattern. What’s new is the middle stage: after landing on a victim’s machine, the attackers deliver a Windows installer disguised as a routine software update. Instead of dropping files to disk in an obvious way, the installer loads a malicious library directly into memory, letting msaRAT run while minimizing the artifacts that traditional file-scanning security tools rely on.

Turning the Browser Into a Covert Channel

Once active, msaRAT searches the compromised system for Chrome or Edge. If either is present, it launches the browser in headless mode — invisible to the user — and enables a remote-debugging interface normally reserved for web developers. Through the Chrome DevTools Protocol, the malware opens a browser session and injects JavaScript into a new tab.

That injected code reaches out to a Cloudflare Workers endpoint to retrieve connection details, then establishes a WebRTC data channel — the same real-time communication technology used by legitimate video calls and collaboration tools. Because WebRTC traffic is common and often trusted by network defenses, it blends easily into normal browsing activity. To further obscure the connection, the traffic is routed through a TURN relay server, which hides the attacker’s real infrastructure from direct view. The data is also encrypted twice over: once by WebRTC’s built-in transport encryption, and again by msaRAT itself before the payload ever reaches the browser.

The net effect is that the malware process on disk only ever talks to the local machine, while it’s the browser — a normally trusted application — that makes the actual external connections. To a defender watching network traffic, this can look like nothing more than Chrome or Edge reaching out to unremarkable infrastructure.

Why This Matters for Detection

This technique undercuts a common assumption in network monitoring: that traffic from a known, trusted browser process is inherently safe. Security teams that filter or de-prioritize alerts simply because traffic originates from chrome.exe or msedge.exe may be giving Chaos operators exactly the blind spot they’re counting on. The initial installer download in this campaign also uses plain HTTP over port 443, which can slip past firewalls configured to trust that port simply because it’s commonly associated with encrypted web traffic.

Talos also points out that Chaos uses this browser-based channel specifically in the window between initial access and the final ransomware deployment — meaning its detection is a chance to intervene before encryption and data theft actually occur, not just after the fact.

Detection and Response Recommendations

Defenders looking to catch this behavior before it escalates should consider the following:

• Investigate any Chrome or Edge process launched with headless mode and remote-debugging flags enabled, particularly on systems that have no legitimate reason to run browser automation
• Watch for browser processes establishing unusual WebRTC connections shortly after an MSI installer or “update” runs
• Inspect web traffic by protocol rather than assuming port 443 traffic is safe by default
• Limit the use of unnecessary remote-management tools across the environment
• Enforce phishing-resistant authentication to reduce the odds of initial compromise via email or vishing
• Monitor file-sharing platforms for unexpected bulk data transfers, a hallmark of Chaos’s data-theft stage

Because no single signal reliably reveals this attack chain on its own, Talos recommends correlating browser telemetry, endpoint process trees, and installer activity together. Organizations that have dealt with Chaos’s established pattern of phishing, vishing, and remote-access abuse should treat any unexplained headless browser launch as a potential early warning sign of a broader intrusion already underway.