Headless Chrome/Edge Launched with CDP Remote Debugging Port

Luís Marques@remotecodeexecution

•updated Jul 24, 2026•5•0•6

Detects the execution of Google Chrome or Microsoft Edge in headless mode by the Windows Installer service (msiexec.exe), utilizing remote debugging ports and custom user-data directories. This behavior is indicative of browser-hijacking techniques, such as those observed in msaRAT, used to establish covert C2 channels by manipulating the browser's CDP interface.