msaRAT turns Chrome and Edge into a covert command channel

Cisco Talos researchers have uncovered a new remote access Trojan called msaRAT, written in Rust. The team links the malware to the group behind the Chaos ransomware. msaRAT can run commands remotely on an infected computer and uses a browser as an intermediary for communication with its command infrastructure.

Once launched, the Trojan creates an asynchronous Tokio runtime and then looks for an installed copy of Chrome or Edge. It starts the browser in headless mode and connects to it through the Chrome DevTools Protocol — a standard interface for browser debugging and automation.

msaRAT does not connect directly to external servers. Instead, it makes the browser execute JavaScript and send requests to a node hosted on Cloudflare Workers. The service is used to obtain parameters and exchange data required to establish a WebRTC connection. After signaling is complete, commands and stolen data are transferred through a WebRTC DataChannel.

As a result, outbound connections appear to come from a normal browser, while network traffic passes through widely used Cloudflare infrastructure and WebRTC services. The Trojan process itself communicates only with the local address 127.0.0.1, which may make it harder for firewalls and monitoring systems to detect.

Cisco Talos calls the technique Living off the Browser. It follows the same principle as Living off the Land attacks, in which attackers rely on tools already installed on a system instead of deploying separate malicious components. In msaRAT's case, the browser becomes an intermediary for a hidden command channel.