Chaos ransomware uses new msaRAT malware that hides command traffic inside Chrome and Edge

Updated: 2026.07.23 3D ago 1 sources

Malware Ransomware Social Engineering & Phishing Threat Actors & APTs

Cisco Talos says the Chaos ransomware group is deploying a new Rust-based backdoor called msaRAT that hides its command traffic by sending it through Google Chrome or Microsoft Edge instead of connecting directly to attacker servers. The malware is loaded in memory from an MSI installer posing as a Windows update, then uses the Chrome DevTools Protocol to control a headless browser, reach a Cloudflare Workers endpoint, and relay encrypted WebRTC traffic through Twilio TURN servers to obscure the attackers’ infrastructure.

Why it matters: This gives attackers a stealthier way to stay in networks and evade security tools because the malware blends into normal browser traffic. Organizations should hunt for the reported indicators, watch for suspicious headless browser activity and remote debugging use, and harden defenses against the email, voice-phishing, and fake IT/software-update lures used to start these intrusions.

Sources

New msaRAT malware uses Chrome, Edge browsers to route C2 traffic

Bill Toulas 2026.07.23 100% relevant

This article establishes a distinct new story because it introduces a newly documented malware family, msaRAT, and specific command-and-control evasion technique tied to Chaos ransomware rather than updating an already tracked incident.