Headless Chrome/Edge spawned with remote-debugging flags by non-browser parent

Ethan Andrews@eandrews

•updated Jul 23, 2026•8•0•27

Detects the execution of Chrome or Edge browsers with --headless and --remote-debugging-port command-line flags when launched by suspicious or non-standard parent processes. This behavior is commonly associated with msaRAT, which leverages the Chrome DevTools Protocol (CDP) to establish a covert Command and Control (C2) channel through a headless browser instance.