Chaos ransomware has unveiled a novel strategy to disguise malicious activities within normal web browsing. By using its msaRAT remote-access tool, the group transforms Chrome and Microsoft Edge into hidden channels for command execution and data exfiltration.
Browser Manipulation Tactics
The technique employed by Chaos ransomware resembles previous threats like fake Chrome update campaigns. However, it diverges by exploiting the browser post-compromise rather than utilizing it as the initial attack vector. The ransomware group, confirmed in February 2025, has been targeting large organizations with sophisticated double-extortion attacks.
Chaos operators typically gain access through phishing and voice phishing, subsequently employing remote-management tools and legitimate file-sharing services to maintain access and extract data. A report from Cisco Talos, shared with Cyber Security News, highlighted the identification of the Rust-based tool msaRAT, attributing it to Chaos. The tool’s name is derived from code labels such as msaOpen and msaClose, which are integral to the malware’s operation within compromised browsers.
Stealthy Network Infiltration
Defenders face challenges detecting this threat, as it mimics regular browser traffic instead of suspicious malware processes reaching attacker-controlled servers. This complicates standard network monitoring and offers ransomware operators another method to evade detection before deploying encryption and ransom demands.
Upon infiltrating a target device, attackers deploy a Windows installer disguised as a software update. This installer loads a malicious library directly into memory, enabling msaRAT to operate while minimizing detection by traditional file-based security tools. The malware searches for Chrome or Edge on the compromised device, launching them in headless mode and activating a remote debugging interface.
Advanced Malware Techniques
Utilizing the Chrome DevTools Protocol, msaRAT initiates a browser session and injects JavaScript into a new tab. This method is akin to the headless-browser abuse seen in Sryxen browser encryption bypass cases. However, Chaos uses it to establish a hidden communications channel rather than primarily for cookie theft.
The injected code queries a Cloudflare Workers endpoint for connection parameters and sets up a WebRTC data channel. Given WebRTC’s common usage for real-time communications, the traffic blends with typical web application activity. The attackers use a TURN relay to mask their server’s true address, with dual encryption applied to the traffic.
Mitigation and Defense Strategies
Chaos employs this browser-based tactic after initial access and prior to executing ransomware. This strategy, combined with phishing, vishing, and remote-management abuse, signals a broader threat presence. Organizations should scrutinize unexpected Chrome or Edge launches on servers and employee devices.
Security teams should investigate any headless browser processes with remote-debugging settings, especially if they initiate unusual WebRTC connections shortly after an MSI installer runs. Network controls need to inspect web traffic by protocol, not just port number, as initial downloads in this campaign use plain HTTP over port 443.
To counteract these threats, organizations should limit unnecessary remote-management software, enforce phishing-resistant authentication, and monitor file-sharing platforms for anomalies. Browser telemetry, endpoint process trees, and installer activities should be correlated for comprehensive threat detection.
Cisco Talos has provided detection coverage, including a ClamAV signature and Snort rules, to aid security teams in identifying this threat. Quick isolation of affected systems is crucial upon identifying malicious installer activity or abnormal browser behavior.
