msaRAT malware routes C2 traffic through browsers

The Chaos ransomware gang deploys msaRAT, a Rust backdoor that hides command-and-control communication by routing it through Chrome or Edge browsers using the Chrome DevTools Protocol. The malware launches a headless browser, injects JavaScript, and relays encrypted traffic through Twilio TURN servers and Cloudflare Workers, avoiding direct network connections and lowering detection risk.