Chaos ransomware uses headless Chrome and Edge for C2

A ransomware group has developed a new technique to conceal its communications by hijacking a victim's own web browser, according to a cybersecurity report published on July 23, 2026. The Chaos ransomware-as-a-service group uses a tool called msaRAT to turn Google Chrome or Microsoft Edge into a covert command-and-control channel, making malicious traffic appear as normal browser activity.

The Rust-based malware, identified by Cisco Talos researchers, is deployed after attackers gain initial access to a Windows system, typically through spam emails, voice phishing, or abuse of remote-management tools. Once on a device, the malware downloads a Windows installer masquerading as a software update. This installer loads a malicious library directly into memory, reducing traces for file-based security tools.

msaRAT then searches for an installed Chrome or Edge browser. If found, it launches the browser in headless mode, meaning it runs without a visible window, and enables the Chrome DevTools Protocol, a built-in debugging interface. The malware injects JavaScript into a new browser tab, which fetches connection details from a Cloudflare Workers endpoint. This establishes a WebRTC...