The C2 Channel Is a Headless Browser

Cisco Talos analyzed msaRAT, a Rust-based RAT that avoids direct C2 connections by using headless Chrome or Edge and the Chrome DevTools Protocol to relay commands.

By hiding malware traffic inside a legitimate browser process, the technique can bypass process-level network monitoring and make detection and attribution harder.

The article also covers related Chaos ransomware activity, including a Sophos-tracked Teams vishing intrusion that used helpdesk impersonation and remote support tools.

That campaign relied on PowerShell, AppData\Roaming, and HKCU Run key persistence, along with segmented infrastructure tied to embedded CA certificates.