Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

Back Thehackernews

Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

Thehackernews •[email protected] (The Hacker News) • July 23, 2026

Share: View original

Learn how to secure AI agents with practical controls for access, visibility, secrets, and risk containment.

Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Chaos Ransomware Deploys msaRAT to Evade Detection via Browsers The Chaos ransomware group has introduced a new Rust-based remote access trojan (RAT) named msaRAT, which disguises command-and-control (C2) traffic through legitimate web browsers like Chrome and Microsoft Edge. By utilizing the Chrome DevTools Protocol, msaRAT can manage communications while appearing as standard browser activity, thus evading network detection. The malware is executed after an initial compromise, typically through phishing methods such as spam emails or vishing. Once installed, msaRAT establishes a covert C2 channel, allowing attackers to send commands and exfiltrate data without raising alarms. This new tactic highlights the evolving sophistication of ransomware groups in leveraging existing software to mask malicious activities. Cisco Talos has confirmed the existence of this RAT and provided details on its operation and capabilities. 8 sources 70

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

T1071 - Application Layer Protocol

Platforms (1)

Ransomware Groups (1)

Tools (1)