Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

Home / Tech / Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

July 23, 2026 dirk 0 Comments 3 tags

Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

The Chaos ransomware group ran its command-and-control through the victim’s own browser. Cisco Talos on Thursday detailed msaRAT, the Rust implant behind it, found on a compromised Windows machine ahead of the encryptor.

The implant never opens an outbound connection of its own. Its process talks to 127.0.0.1 and nothing else. It starts Chrome or Edge in headless mode and drives the browser

Source: The Hacker News

Explore More

Grok Build Uploads Entire Git Repositories to xAI Storage, Not Just Files It Reads

Grok Build Uploads Entire Git Repositories to xAI Storage, Not Just Files It Reads xAI’s Grok Build coding CLI was uploading entire Git repositories, full commit history and all, to

Modern Decor May Be Straining People’s Brains

Modern Decor May Be Straining People’s Brains Source: Hacker News

The Scripts on Your Checkout Page Are Now a PCI DSS Problem

The Scripts on Your Checkout Page Are Now a PCI DSS Problem An independent PCI assessor tested Reflectiz against the new PCI DSS rules. Here is the verdict: See the