Non-Browser Process Connecting to Localhost CDP Debug Port 9222

Duo Tech@duotech

•updated Jul 24, 2026•0•0•1

A non-browser process pivoting through the browser's CDP loopback debug port, so the RAT's own traffic never leaves 127.0.0.1. Tightened to exclude known developer tooling and browser automation frameworks (VS Code debugger, Chrome DevTools frontend, Selenium/Puppeteer/Playwright drivers) that legitimately attach to the local CDP debug port.