Chaos Ransomware Hijacks Chrome and Edge for Stealthy C2

The Chaos ransomware group uses a Rust-based implant called msaRAT to route command-and-control traffic through the victim's own Chrome or Edge browser in headless mode. Cisco Talos discovered the implant on a compromised Windows machine, where it communicates only with localhost, avoiding outbound connections. This technique makes detection harder by blending malicious traffic with legitimate browser activity.