Msiexec Process Connects to Chrome/Edge over Loopback

Luís Marques@remotecodeexecution

•updated Jul 24, 2026•0•0•1

Detects instances where the Microsoft Installer process (msiexec.exe) initiates a network connection to the local IPv4 loopback address (127.0.0.1). This behavior may indicate an MSI custom-action payload attempting to interact with a web browser through the Chrome DevTools Protocol (CDP) to establish a covert command-and-control channel.