Chaos Ransomware Turns Your Chrome and Edge Web Browser Into an Invisible Malware Command Channel

Cybersecuritynews •Tushar Subhra Dutta • July 23, 2026

Chaos ransomware has introduced a new way to hide attacker activity inside everyday web browsing. The group’s msaRAT remote-access tool turns Chrome or Microsoft Edge into a covert channel for receiving commands and moving data. This approach mirrors the stealth concerns raised by fake Chrome update malware campaigns, but uses the browser after compromise rather than as […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Chaos Ransomware Deploys msaRAT to Evade Detection via Browsers The Chaos ransomware group has introduced a new Rust-based remote access trojan (RAT) named msaRAT, which disguises command-and-control (C2) traffic through legitimate web browsers like Chrome and Microsoft Edge. By utilizing the Chrome DevTools Protocol, msaRAT can manage communications while appearing as standard browser activity, thus evading network detection. The malware is executed after an initial compromise, typically through phishing methods such as spam emails or vishing. Once installed, msaRAT establishes a covert C2 channel, allowing attackers to send commands and exfiltrate data without raising alarms. This new tactic highlights the evolving sophistication of ransomware groups in leveraging existing software to mask malicious activities. Cisco Talos has confirmed the existence of this RAT and provided details on its operation and capabilities. 8 sources 70

Extracted Entities

Chaos Ransomware Turns Your Chrome and Edge Web Browser Into an Invisible Malware Command Channel

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Ransomware Groups (1)

Tools (1)