Chaos Ransomware Turns Your Chrome and Edge Web Browser Into an Invisible Malware Command Channel

Chaos ransomware has introduced a new way to hide attacker activity inside everyday web browsing.

The group’s msaRAT remote-access tool turns Chrome or Microsoft Edge into a covert channel for receiving commands and moving data.

This approach mirrors the stealth concerns raised by fake Chrome update malware campaigns, but uses the browser after compromise rather than as the initial lure.

The ransomware-as-a-service group was first confirmed in February 2025 and has targeted large organizations with double-extortion attacks.

Its operators commonly gain entry through spam emails and voice phishing, then use remote-management tools and legitimate file-sharing services to keep access and steal data.

Cisco Talos said in a report shared with Cyber Security News (CSN) that it identified the Rust-based malware, named msaRAT, as a tool linked to Chaos.

The name comes from code labels including msaOpen, msaClose, msaError, and msaMessage, which help connect the malware with activity inside the hijacked browser.

The finding matters because defenders may see what appears to be normal browser traffic, not a suspicious malware process reaching an attacker-controlled server.

That makes standard network monitoring less reliable and gives ransomware operators another way to remain hidden before they deploy encryption and ransom notes.

Chaos Ransomware Turns Your Chrome and Edge Web Browser

After getting onto a victim’s device, the attackers download a Windows installer that pretends to be a software update.

The installer loads a malicious library directly into memory, allowing msaRAT to run while reducing the visible traces that traditional file-based security tools may detect.

The malware then searches for Chrome or Edge on the compromised computer. If it finds either browser, it launches it in headless mode, meaning it runs without a visible window, and enables a remote debugging interface designed for developers.

Through Chrome DevTools Protocol, msaRAT opens a browser session and injects JavaScript into a new tab.

The technique is similar in principle to the headless-browser abuse described in the Sryxen browser encryption bypass, although Chaos uses the feature to build a concealed communications path rather than primarily steal cookies.

The injected code asks a Cloudflare Workers endpoint for connection details and creates a WebRTC data channel. WebRTC is widely used for real-time browser communications, so its use can blend in with normal traffic generated by web applications and collaboration services.

The attackers route the connection through a TURN relay, preventing a direct connection to their server and concealing its real address. Traffic is also encrypted twice: WebRTC applies transport encryption, while msaRAT separately encrypts the data before passing it into the browser.

This design leaves the malware process communicating only with the local machine while the browser makes the external requests.

Security teams may therefore see Chrome or Edge contacting legitimate-looking infrastructure, a situation that resembles the challenges reported in browser-based ransomware abuse cases.

Detection and Defensive Steps

Chaos uses this browser-led approach after initial access and before the final ransomware stage.

The group’s established pattern of phishing, vishing, remote-management abuse, and data theft means organizations should treat suspicious browser launches on servers and employee devices as possible signs of a broader intrusion.

Defenders should investigate Chrome or Edge processes launched with headless and remote-debugging settings, especially when they appear unexpectedly on systems that do not normally require browser automation.

They should also look for browser processes making unusual WebRTC connections shortly after an MSI installer or supposed update runs.

Network controls should inspect web traffic by protocol rather than trusting port 443 alone. In this campaign, the initial download uses plain HTTP over port 443, which may slip past firewalls that permit traffic simply because it uses a commonly trusted port number.

Organizations should limit unnecessary remote-management software, enforce phishing-resistant sign-in controls, and monitor file-sharing platforms for unexpected bulk transfers.

Browser telemetry, endpoint process trees, and installer activity should be correlated, because no single signal may reveal the full attack chain.

The communications method also highlights why defenders cannot assume encrypted or browser-originated traffic is safe. Similar concerns have surfaced in the Ghost Calls command channels, where legitimate communication technologies can help attackers hide control traffic.

Cisco Talos said its available detection coverage includes a ClamAV signature and Snort rules for this threat.

Teams should validate those controls in their environment, hunt for the listed indicators, and isolate affected systems quickly if malicious installer activity or abnormal headless browser behavior is found.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

ALERT!: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.