msaRAT Malware: How This Browser-Hijacking RAT Hides Its Command Channel

msaRAT is a remote access trojan linked to the Chaos ransomware group. It can execute commands, capture screenshots and transfer files while hiding its command traffic behind a Chrome or Edge browser process.

The browser is not the infection. The danger is a malicious Rust program controlling it through developer features and tunneling communications over WebRTC. If msaRAT is suspected, isolate the computer and treat the incident as a broader network compromise.

msaRAT Malware Overview

msaRAT is a Rust-based remote access trojan associated with the Chaos ransomware operation. Its defining feature is the way it communicates. Instead of opening network connections directly from the malware process, msaRAT launches or controls Chromium-based browsers through the Chrome DevTools Protocol. Chrome or Microsoft Edge then carries the command-and-control traffic on the malware’s behalf.

The malware can establish a WebRTC DataChannel and relay traffic through familiar cloud and communications services. Browser automation, Cloudflare Workers signaling and a Twilio TURN relay can create an encrypted path to the attacker. Defenders may therefore see an approved browser reaching common internet services instead of an unknown executable contacting an obvious criminal server.

Observed capabilities include remote shell access, screenshots and file transfer, enough to steal data, deploy tools and prepare ransomware. The identified sequence used update_ms.msi to impersonate a Windows update, load a malicious DLL in memory and start a headless browser with remote debugging. It occurred after attackers already had access, so the fake update is a post-compromise tool rather than a universal initial-delivery method.

Why msaRAT’s browser technique matters

• The RAT avoids making its own direct command-and-control connection.
• Chrome or Edge becomes the visible network client.
• Encrypted WebRTC traffic can conceal the contents of attacker commands.
• Legitimate relay and cloud services can make simple domain blocklists less effective.
• Headless browser activity may occur without a normal window appearing on screen.
• The attacker can run commands, move files and capture the desktop through the same channel.

A normal Chrome or Edge process is not evidence of msaRAT by itself. Detection depends on the full pattern: unexpected remote-debugging arguments, unusual headless instances, suspicious MSI or DLL activity, browser processes launched by abnormal parents and WebRTC behavior that does not match the user’s activity.

How the msaRAT Infection Chain Works

Step 1: Attackers obtain an initial foothold

The documented msaRAT activity begins after a system has already been compromised. The Chaos group has used methods including spam, social engineering and voice phishing in wider operations, but organizations should investigate every plausible entry point rather than assuming one email delivered this specific RAT.

Step 2: A fake Windows update package is downloaded

The attacker uses an existing foothold to retrieve an MSI installer named update_ms.msi into the ProgramData area. The observed command used curl and an unusual plain-HTTP transfer on port 443. The Windows-update name is camouflage intended to make the file look administrative.

Step 3: A malicious DLL is loaded in memory

The MSI extracts the msaRAT component and loads it without relying on a normal visible application window. In-memory execution can reduce obvious disk artifacts and helps the trojan blend into an already compromised system.

Step 4: Chrome or Edge starts in headless debug mode

msaRAT launches a Chromium browser with remote debugging enabled and controls it through the Chrome DevTools Protocol. Headless mode means the browser can operate without displaying the familiar interface to the user.

Step 5: The browser creates a covert WebRTC tunnel

The controlled browser uses WebRTC and relay infrastructure to establish an encrypted DataChannel. The RAT passes commands and results through the browser, so the malware executable itself does not need a conventional outbound socket to the attacker’s server.

Step 6: The operator controls the victim and stages further attacks

Through msaRAT, the attacker can run shell commands, take screenshots and transfer files. That access can support reconnaissance, data theft, credential discovery, lateral movement and deployment of ransomware or other payloads.

What msaRAT Can Do on a Compromised Computer

Run commands remotely

Remote shell access lets an operator query the operating system, inspect accounts, enumerate folders, change settings and launch additional programs. Command execution turns the infected computer into an interactive foothold rather than a one-time data-stealing event.

Capture screenshots

Screenshots can expose internal dashboards, customer records, chat conversations, administrator tools and other information that may not be saved in an easily searchable file. They also help the operator understand what the victim is doing.

Upload and download files

File transfer supports both data theft and further compromise. Attackers can remove documents from the system or deliver credential dumpers, network tools, ransomware and updated malware components.

Hide communications in browser traffic

The malware’s most distinctive capability is its use of a controlled browser for command traffic. This does not make the RAT invisible, but it means defenders must inspect process behavior and browser launch context instead of trusting traffic merely because Chrome or Edge produced it.

Warning Signs That Deserve Investigation

• Chrome or Edge runs headless when no approved automation should be active.
• A browser starts with remote-debugging flags or an unexpected debugging port.
• An unfamiliar update_ms.msi file appears in ProgramData or a temporary folder.
• An MSI installation is followed by unusual DLL loading or browser launches.
• Chrome or Edge is started by a command shell, installer or process that normally would not open it.
• WebRTC or relay traffic continues from a server or workstation with no matching user activity.
• Security logs show unexpected use of curl, PowerShell or remote-management commands.
• New files, screenshots or archives appear near sensitive data locations.

These indicators require context. Developers, automated testing tools and enterprise applications can legitimately use headless browsers or remote debugging. The suspicious combination is an unapproved installer, abnormal parent process, persistent debug-enabled browser and unexplained remote activity.

What to Do If You Suspect msaRAT

Isolate the computer immediately

Disconnect network access without using the suspected machine to research the malware. msaRAT is designed for interactive remote control, and continued connectivity gives the operator more time to steal data or move deeper into the environment.

Escalate it as an incident, not a browser problem

Closing Chrome or uninstalling Edge does not address the original compromise. The RAT launches and controls the browser; the browser itself is not the root cause. Business systems should be examined by an incident-response team that can identify the initial foothold and every affected account or host.

Preserve volatile and process evidence

Record active processes, command lines, network connections, installed MSI packages, recent file creation and browser debugging configuration before wiping the device. That evidence can reveal the attack timeline and help locate additional compromised systems.

Secure credentials from a clean device

Assume passwords, tokens and administrator secrets used on the system may be exposed. Reset them from a trusted computer, revoke existing sessions and rotate service credentials. Prioritize domain administrators, remote access, email, cloud consoles and backup systems.

Scan, rebuild and hunt across the environment

A reputable scan can detect known components, but an attacker who had enough access to deploy msaRAT may have installed other persistence. Reimage high-risk systems from trusted media and search other endpoints for the same installer, DLL behavior, browser command-line flags and network pattern.

If you suspect your computer is infected with malware — slow performance, pop-ups, redirects, or programs you don’t recognize — follow the free step-by-step removal guide below to clean it completely.

Remove Malware from Windows [Step-by-Step Guide]

• STEP 1: Uninstall malicious programs from Windows
• STEP 2: Reset browsers back to default settings
• STEP 3: Use Rkill to terminate suspicious programs
• STEP 4: Use Malwarebytes to remove Trojans and unwanted programs
• STEP 5: Use HitmanPro to remove rootkits and other malware
• STEP 6: Use AdwCleaner to remove malicious browser policies and adware
• STEP 7: Perform a final check with ESET Online Scanner

STEP 1: Uninstall malicious programs from Windows

First, we’ll manually check your computer for unknown or malicious programs. Adware and browser hijackers often have a working uninstall entry — removing them this way takes care of the easy part before we run the scanners.

With the malicious programs removed, you’re ready for the next step in this guide.

STEP 2: Reset browsers back to default settings

In this step, we will remove spam notifications,  malicious extensions, and change to default any settings that might have been changed by malware.
Please note that this method will remove all extensions, toolbars, and other customizations but will leave your bookmarks and favorites intact. For each browser that you have installed on your computer, please click on the browsers tab below and follow the displayed steps to reset that browser.

STEP 3: Use Rkill to terminate suspicious programs

Next, we’ll download and run Rkill to stop any suspicious processes running in the background. This prevents the malware from interfering with the removal tools in the following steps.

RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes so that your normal security software can then run and clean your computer of infections. When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies that stop us from using certain tools.

1. Download Rkill.

   You can download RKill to your computer from the below link. When at the download page, click on the Download Now button labeled iExplore.exe. We are downloading a renamed version of Rkill (iExplore.exe) because some malware will not allow processes to run unless they have a certain filename.

   

   RKILL DOWNLOAD LINK
   (The above link will open a new page from where you can download Rkill)

2. Run RKill.

   After downloading, double-click the iExplore.exe icon to kill malicious processes. In most cases, downloaded files are saved to the Downloads folder.
   The program may take some time to search for and end various malware programs.

   

   When it is finished, the black window will close automatically and a log file will open. Do not restart your computer. Proceed to the next step in this guide.

STEP 4: Use Malwarebytes to remove Trojans and unwanted programs

Now we’ll install Malwarebytes and run a full scan to detect and remove infections, adware, and potentially unwanted programs from your computer.

Malwarebytes is one of the most popular and trusted anti-malware tools for Windows — and it’s completely free for removing infections. It catches threats that many antivirus programs miss, including adware, browser hijackers, and trojans. Follow the steps below to scan and clean your PC in just a few minutes.

1. Download Malwarebytes

   Click the button below to download the latest version of Malwarebytes for Windows from the official source. The free version is all you need — it will scan your computer and remove adware, browser hijackers, and other malicious software at no cost.

   

   DOWNLOAD MALWAREBYTES FOR WINDOWS (FREE)
   
   (The link opens in a new page where your download will start)

2. Install Malwarebytes

   When the download finishes, open your Downloads folder and double-click the MBSetup file. If Windows shows a User Account Control pop-up, click “Yes” to allow the installation.

   

3. Follow the On-Screen Prompts to Install Malwarebytes

   The setup wizard will walk you through a few quick screens:

   • Choose where you’re installing the program — “Personal Computer” or “Work Computer” — then click Next.

     

   • Malwarebytes will now install on your device. This usually takes under a minute.

     

   • When installation is complete, the “Welcome to Malwarebytes” screen will open automatically.

     

   • On the final screen, click Open Malwarebytes to launch the program.

     

4. Enable “Scan for Rootkits”

   Before scanning, turn on rootkit detection so Malwarebytes can find even the most hidden threats. Click the Settings gear icon on the left side of the screen.

   

   In the settings menu, find “Scan for rootkits” and click the toggle so it turns blue.

   

   Done? Click “Dashboard” in the left pane to return to the main screen.

5. Start the Scan

   Click the blue Scan button. Malwarebytes will automatically update its virus database and start checking your computer for malware.

   

6. Wait for the Scan to Finish

   The scan checks your entire system for browser hijackers and other malicious programs, so it can take several minutes. Feel free to do something else — just check back occasionally to see the progress.

   

7. Quarantine the Detected Threats

   When the scan is done, you’ll see a list of everything Malwarebytes found — malware, adware, and potentially unwanted programs. Click the “Quarantine” button to remove all of them at once.

   

   Malwarebytes will now remove the malicious files and registry entries and move them safely into quarantine.

   

8. Restart Your Computer

   Some threats can only be fully removed after a reboot. If Malwarebytes asks you to restart, click Yes. Once you’re logged back in, your PC is clean and you can continue with the next steps in this guide.

   

STEP 5: Use HitmanPro to remove rootkits and other malware

Next, we’ll run a second-opinion scan with HitmanPro to catch Trojans, rootkits, and other malicious programs that may have survived the previous step.

HitmanPro is a second-opinion scanner — it’s designed to catch what your main antivirus might have missed. Instead of relying on a single detection engine, it checks the behavior of files in the locations where malware usually hides. Anything suspicious gets sent to the cloud, where it’s analyzed by two of the best antivirus engines available: Bitdefender and Kaspersky.

Good news: scanning is completely free, with no limits. You only need a license when it’s time to remove what was found — and even then, you can activate a free one-time 30-day trial to clean your PC at no cost. (A full license is $24.95 per year for 1 PC.)

1. Download HitmanPro

   Click the button below to download HitmanPro. Remember — the scan is free, so you have nothing to lose by checking your PC.

   DOWNLOAD HITMANPRO (FREE SCAN)
   (The link opens in a new page where your download will start)

2. Install HitmanPro

   When the download finishes, open your Downloads folder and double-click the file: “hitmanpro.exe” on 32-bit Windows, or “hitmanpro_x64.exe” on 64-bit Windows.

   

   If a User Account Control pop-up asks whether HitmanPro can make changes to your device, click “Yes” to continue.

   

3. Follow the On-Screen Prompts

   On the HitmanPro start screen, click “Next” to begin the system scan. No lengthy setup required — it goes straight to work.

   

   

4. Wait for the Scan to Finish

   HitmanPro will now check your computer for malicious programs. This usually takes just a few minutes thanks to its cloud-based scanning.
   

5. Review the Results and Click “Next”

   When the scan is done, HitmanPro will show you everything it found. Click “Next” to remove the detected threats.

   

6. Click “Activate Free License”

   To remove the malicious files, click the “Activate free license” button. This starts your free 30-day trial — no payment details needed — and unlocks the full cleanup.
   

   When the removal is complete, HitmanPro will show a summary of everything it cleaned. Click Next, then click Reboot if prompted. If there’s no reboot prompt, just click Close — your PC is clean.

STEP 6: Use AdwCleaner to remove malicious browser policies and adware

We’ll now use AdwCleaner to remove malicious browser policies and unwanted browser extensions — the leftovers that keep hijacking your browser settings even after the malware itself is gone.

AdwCleaner is a free on-demand scanner that specializes in adware, browser hijackers, and unwanted toolbars — the exact threats that mainstream antivirus programs often miss. It also includes tools that repair the damage malware leaves behind, like hijacked browser settings and malicious policies. It’s a quick scan that’s well worth running.

1. Download AdwCleaner

   Click the button below to download AdwCleaner — it’s free, portable, and requires no installation.

   

   DOWNLOAD ADWCLEANER (FREE)
   (The link opens in a new page where your download will start)

2. Run AdwCleaner

   Open your Downloads folder and double-click the file named “adwcleaner_x.x.x.exe“. There’s no installation — the program starts right away.
   

   If Windows asks whether you want to allow AdwCleaner to run, click “Yes“. When the license agreement appears, click I agree to continue.

   

3. Enable “Reset Chrome policies”

   This setting removes malicious browser policies — a trick malware uses to lock your browser settings so you can’t change them back. Click “Settings” on the left side of the window, then turn on “Reset Chrome policies“.

   

4. Start the Scan

   Click “Dashboard” on the left side of the window, then click the “Scan” button.

   

5. Wait for the Scan to Finish

   AdwCleaner will now check your computer for adware and other malware. This usually takes only a few minutes — it’s one of the fastest scanners around.

   

6. Quarantine the Detected Threats

   When the scan finishes, AdwCleaner will list everything it found. Click the “Quarantine” button to remove all the malicious items at once.

   

7. Click “Continue” to Finish the Cleanup

   Save any open work first — AdwCleaner needs to close your open programs before it can clean. When you’re ready, click the “Continue” button.
   

   AdwCleaner will now delete all detected malware from your computer. If it asks you to restart your PC, allow it — your computer will be clean when you log back in.

STEP 7: Perform a final check with ESET Online Scanner

Finally, we’ll run ESET Online Scanner as a last sweep to confirm nothing was missed. If this scan comes back clean, your computer is malware-free.

ESET Online Scanner is a free second-opinion scanner that performs a deep, full-system check for viruses, trojans, rootkits, and other malware. We use it as the final step because it’s thorough — if anything slipped past the previous scans, ESET will find it. A clean result here means your computer is malware-free.

1. Download ESET Online Scanner

   Click the button below to download ESET Online Scanner.

   

   DOWNLOAD ESET ONLINE SCANNER (FREE)
   (The link opens in a new page where your download will start)

2. Run the Installer

   When the download finishes, open your Downloads folder and double-click “esetonlinescanner.exe“.
   

3. Install ESET Online Scanner

   On the start screen, select your language from the drop-down menu and click Get started.

   

   On the Terms of use screen, click Accept.
   

   Choose your preferences for the Customer Experience Improvement Program and the Detection feedback system (either choice is fine), then click Continue.
   

4. Start a Full Scan

   Click Full Scan — this checks your entire computer, not just the common hiding spots.

   

   Select Enable for Detection of Potentially Unwanted Applications — this lets ESET catch adware and bundled junk programs, not just viruses. Then click Start scan.

   

5. Wait for the Scan to Finish

   ESET will now check every file on your computer. Because it’s a full scan, this can take a while — often an hour or more, depending on how much data you have. Leave it running in the background and check on it from time to time.

   

6. Review the Results

   When the scan completes, the Found and resolved detections screen appears. Any threats found were automatically cleaned and quarantined — there’s nothing extra you need to do. Click View detailed results if you want to see exactly what was removed.
   

   If ESET found nothing — congratulations, your computer has passed the final check and is malware-free.

That’s it — your Windows computer is now clean. The Trojans, adware, and any other malware have been removed.

If your current antivirus allowed this malicious program on your computer, you may want to consider purchasing Malwarebytes Premium to protect against these types of threats in the future.
If you are still having problems with your computer after completing these instructions, then please follow one of the steps:

• Run a computer scan with ESET Online Scanner
• Ask for help in our Windows Malware Removal Help & Support forum.

How to Reduce Exposure to Browser-Abusing Malware

• Restrict who can install MSI packages and monitor installations from user-writable folders.
• Alert on Chrome or Edge launched headless with remote debugging on ordinary endpoints.
• Log complete process command lines and parent-child relationships.
• Use application control to block unapproved executables and DLL loading paths.
• Limit PowerShell, curl and remote administration tools to accounts that need them.
• Require multi-factor authentication for remote access and privileged accounts.
• Segment endpoints from critical servers and protect backup systems with separate credentials.
• Inspect cloud and WebRTC activity in context instead of automatically trusting a known service.

The Bottom Line

msaRAT is a capable remote access trojan that turns Chrome or Edge into a covert command channel. By combining browser automation, WebRTC and legitimate relay infrastructure, it can make malicious control traffic resemble ordinary browser activity.

Do not solve this by deleting the browser. Isolate the computer, preserve evidence, reset exposed credentials and investigate the entire intrusion. Because the observed RAT is linked to a ransomware operation, fast containment can be the difference between one compromised endpoint and a wider data-theft or encryption incident.