The Chaos ransomware gang has a new tool that turns a victim's own web browser into a covert communications channel, letting the malware talk to its operators without ever opening a suspicious network connection of its own. Researchers at Cisco Talos, who discovered the Rust-based remote access trojan and named it "msaRAT", say it is the latest addition to the toolkit of a crew known for double-extortion attacks on large organizations.
Chaos is a ransomware-as-a-service operation first confirmed in February 2025. It typically breaks in through spam email and phone-based social engineering, or vishing, then abuses legitimate remote-management software to stay resident and file-sharing tools to steal data before deploying its encryptor.
Living off the browser
What sets msaRAT apart is how it hides. Rather than beaconing out to a command-and-control server directly, the malware quietly launches Chrome or Edge in headless mode and drives it through the Chrome DevTools Protocol, a legitimate browser-debugging interface. It then uses the browser to set up a WebRTC data channel to the attackers, relayed through Twilio's TURN service, with a Cloudflare Workers endpoint handling the initial signaling. Because the malware itself never opens a network socket, traffic that would normally trip alarms is disguised as ordinary browser activity. The name comes from function bindings inside the binary: "msaOpen", "msaClose", "msaError" and "msaMessage".
How it gets in
According to Talos, once the attackers have a foothold they run a curl command to download an installer named "update_ms.msi" that is disguised as a Windows update. Notably, the download uses plain HTTP over port 443, so firewalls that judge traffic by port number alone without inspecting the protocol will wave it through. The MSI loads a DLL (msaRAT) directly into memory, which spins up an asynchronous runtime, hunts for a Chrome or Edge install, and injects JavaScript to build the hidden channel. If no supported browser is found, the covert C2 simply does not activate.
What you should do
Defenders should treat unexpected headless-browser launches with remote-debugging flags as a red flag, and inspect traffic by protocol rather than trusting port numbers. Watch for the download URL hxxp://172[.]86[.]126[.]18:443/update_ms[.]msi and the delivery IP 172[.]86[.]126[.]18. Because Chaos leans on vishing and remote-management abuse for access, phishing-resistant controls and tight monitoring of RMM tools remain the front line. The technique adds to a wave of ransomware crews investing in stealthier tooling, alongside groups like the operators behind WhiteLock, which kills remote tools to block recovery.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.