Listen to this Post
Introduction, A New Era of Browser-Powered Cyber Attacks
Cybercriminals are constantly searching for ways to blend into legitimate network activity, making their malicious operations nearly impossible to distinguish from everyday internet traffic. Traditionally, malware establishes a direct connection with its command-and-control (C2) server, giving defenders opportunities to detect suspicious network behavior. However, researchers have now uncovered a sophisticated remote access trojan that challenges this security model entirely.
Cisco Talos has disclosed msaRAT, a highly advanced Rust-based Remote Access Trojan (RAT) linked to the Chaos ransomware group. Instead of communicating directly with attacker infrastructure, msaRAT hijacks the victim’s own Chrome or Microsoft Edge browser to relay every command through legitimate web technologies. The malware itself never connects to the internet, making traditional detection methods far less effective.
This innovative technique demonstrates how modern threat actors increasingly abuse trusted applications and cloud services rather than relying on obviously malicious infrastructure. As enterprises continue to permit browser traffic, WebRTC communication, and cloud platforms such as Cloudflare and Twilio, defenders face an entirely new challenge.
Cisco Talos Reveals
Cisco Talos researchers discovered that msaRAT completely avoids making outbound network connections itself.
Instead, every communication between the attacker and the infected machine is handled by the victim’s own browser through the Chrome DevTools Protocol (CDP). CDP is a legitimate debugging interface used by developers for inspecting and controlling browser sessions.
This means the malware delegates all networking responsibilities to Chrome or Edge, allowing the RAT process to remain completely invisible from a network communication perspective.
Unlike traditional malware, no suspicious executable is seen contacting an external server.
Using Legitimate Browser Features as a Weapon
After compromising a Windows system, the attackers download a malicious installer named update_ms.msi using curl.exe.
Interestingly, although the connection occurs over TCP port 443, the traffic itself uses plain HTTP instead of HTTPS. Security devices that only inspect destination ports instead of actual protocols may mistakenly classify this traffic as secure and allow it through.
The installer impersonates a Windows update package.
Instead of dropping files onto disk, it loads the malicious DLL directly into memory using a custom Windows Installer action, reducing forensic artifacts.
Browser Discovery Before Malware Activation
msaRAT cannot operate without Chrome or Microsoft Edge.
Before activating its communication routines, the malware carefully searches for installed browsers by checking Windows environment variables in a predefined priority order.
If these methods fail, it searches the Windows Registry specifically for Google Chrome installations.
Without a supported browser, the malware cannot establish its hidden communication channel.
This dependency is unusual but central to its stealth strategy.
Launching a Hidden Browser Session
Once Chrome or Edge is located, the malware launches the browser in Headless Mode.
It enables the
Because everything occurs locally through 127.0.0.1, there is no direct malware-generated outbound traffic.
Using CDP commands, msaRAT disables browser Content Security Policy protections before injecting custom JavaScript responsible for all future network communication.
The browser becomes an unwilling proxy for the attacker.
Cloudflare Workers Handle Initial Communication
The malware contains a Cloudflare Workers endpoint.
However, this endpoint is only used during the initial signaling phase required to establish a WebRTC connection.
Cloudflare Workers facilitate the exchange of SDP Offer and Answer messages between attacker and victim.
Once the secure session has been established, Cloudflare disappears entirely from the communication chain.
The browser then communicates exclusively through WebRTC.
Twilio Relay Conceals the
Instead of allowing direct peer-to-peer WebRTC communication, the attackers intentionally omit ICE candidates.
This design forces every packet through Twilio TURN relay servers.
Because Twilio operates a legitimate global communications platform, network administrators simply observe normal browser traffic destined for trusted infrastructure.
The
This dramatically complicates network attribution and forensic investigations.
Double Encryption Adds Another Layer of Protection
WebRTC already encrypts traffic using DTLS.
However, msaRAT introduces a second encryption layer before data even enters the browser.
The malware encrypts every payload using ChaCha20-Poly1305, with keys generated dynamically through an Elliptic Curve Diffie-Hellman (ECDH) key exchange during session establishment.
Even if an attacker intercepted WebRTC traffic and somehow bypassed DTLS protections, the application-level encryption would still prevent data from being read.
This layered cryptographic approach significantly strengthens attacker operational security.
Why Traditional Firewalls See Nothing Suspicious
From the
The browser communicates with:
Cloudflare Workers
Twilio TURN relay servers
Standard HTTPS services
Normal WebRTC traffic
The malware executable itself never creates outbound connections.
Every external communication originates from a legitimate browser process.
This design hides malicious activity inside ordinary enterprise web traffic.
Chaos Ransomware Uses msaRAT Before Encryption
Cisco Talos observed msaRAT being deployed after attackers obtained initial access but before ransomware execution.
This behavior aligns closely with the known operational workflow of the Chaos ransomware group.
The RAT provides attackers with:
Persistent remote access
Internal reconnaissance
Command execution
Network exploration
Preparation for ransomware deployment
Only after collecting sufficient intelligence do attackers launch the ransomware encryptor.
Detection Remains Possible Through Behavioral Indicators
Although network detection becomes significantly harder, defenders can still identify suspicious behaviors.
Cisco Talos recommends watching for:
Browser processes launched with –remote-debugging-port
Chrome or Edge executing in Headless Mode
curl.exe downloading MSI installers into C:ProgramData
certutil.exe retrieving suspicious payloads
Unexpected HeadlessChrome user-agent strings
MSI installers immediately spawning browser debugging sessions
Talos has also released:
ClamAV signature: Win.Downloader.ChaosRaas-10060321-0
Snort detection rules
Complete Indicators of Compromise (IOCs)
These resources provide organizations with valuable detection capabilities despite the malware’s stealth.
Deep Analysis
The following Windows commands can assist security analysts in investigating indicators related to browser abuse and suspicious installer activity.
Check Running Chrome or Edge Processes
tasklist | findstr chrome tasklist | findstr msedge
Identify Remote Debugging Flags
wmic process get ProcessId,CommandLine | findstr remote-debugging
Search for Headless Chrome Sessions
wmic process get CommandLine | findstr headless
Review Network Connections
netstat -ano
Monitor curl Activity
Get-WinEvent -LogName Security | findstr curl.exe
Search for Suspicious MSI Files
dir C:\ProgramData.msi /s
Check Browser Installation Paths
reg query "HKLM\Software\Google\Chrome" reg query "HKLM\Software\Microsoftdge"
Detect Unusual Parent-Child Processes Using Sysmon
Get-WinEvent -LogName Microsoft-Windows-Sysmon/Operational
Review PowerShell Execution Logs
Get-WinEvent -LogName "Windows PowerShell"
Hunt for Suspicious Downloads
Get-ChildItem C:\ProgramData -Recurse
These investigations should be complemented with Sysmon telemetry, endpoint detection platforms, browser forensic analysis, and memory acquisition to identify fileless malware behavior that traditional antivirus solutions may miss.
What Undercode Say
The emergence of msaRAT represents more than just another remote access trojan. It highlights a broader transformation in modern cyber warfare where attackers increasingly exploit trusted software rather than attempting to evade it.
For years, defenders focused heavily on identifying malicious network connections. This strategy worked because malware eventually had to contact attacker-controlled servers. msaRAT fundamentally changes that assumption.
By outsourcing communication to Chrome and Edge, attackers inherit the browser’s reputation. Firewalls, proxies, secure web gateways, and intrusion detection systems generally trust browser traffic. Instead of breaking security controls, attackers simply move inside them.
Another concerning aspect is the deliberate combination of multiple trusted services. Cloudflare Workers perform signaling, Twilio relays WebRTC traffic, Chrome manages encrypted communication, and Windows Installer launches the payload. None of these technologies are malicious individually. Together, however, they create a nearly invisible attack chain.
The use of Rust is also significant. Rust provides memory safety, portability, and increasingly attracts malware developers seeking reliable, modern tooling. Over the past few years, Rust-based malware families have steadily increased in sophistication.
Perhaps the most important lesson is that defenders must move beyond signature-based detection. Behavioral analytics, process lineage monitoring, command-line inspection, and endpoint telemetry are becoming essential. Security teams should pay particular attention to browsers launched with remote debugging flags, especially when initiated by MSI installers or command-line utilities like curl.exe and certutil.exe.
Organizations should also reconsider the assumption that browser traffic is inherently trustworthy. Browser security monitoring should include WebRTC usage, headless browser detection, and unexpected DevTools activity. While blocking WebRTC outright may not be practical for many enterprises, unusual browser automation deserves closer scrutiny.
Finally, msaRAT demonstrates that ransomware operators continue investing heavily in stealth rather than brute force. The encryption phase is no longer the most sophisticated part of the attack. Instead, attackers spend significant effort remaining undetected during reconnaissance and persistence. Enterprises that detect these early-stage behaviors can prevent ransomware deployment long before files are encrypted.
Prediction
(-1) The techniques introduced by msaRAT are likely to spread rapidly across the cybercrime ecosystem. More ransomware groups and advanced persistent threat actors will adopt browser-based command-and-control channels, trusted cloud relays, and encrypted WebRTC communications to evade conventional security monitoring. This evolution will push defenders toward deeper behavioral analytics, browser telemetry, and AI-assisted threat hunting rather than relying primarily on network signatures or domain blocking.
✅ Fact: Cisco Talos publicly documented msaRAT as a Rust-based remote access trojan associated with the Chaos ransomware ecosystem that abuses Chrome DevTools Protocol for browser-mediated command-and-control.
✅ Fact: The malware leverages legitimate technologies including Chrome or Edge, WebRTC, Cloudflare Workers, and Twilio TURN relays, making its communications resemble normal browser activity rather than traditional malware traffic.
✅ Fact: Behavioral indicators such as browsers launched with remote debugging flags, Headless Chrome execution, suspicious MSI installers, and unusual use of curl.exe or certutil.exe provide realistic opportunities for defenders to detect the malware despite its advanced evasion techniques.
▶️ Related Video (76% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: securityaffairs.com
Extra Source Hub (Possible Sources for article):
https://www.quora.com/topic/Technology
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
