msaRAT headless browser signaling GET to Cloudflare Workers with spoofed Microsoft headers

Emiliano Mema@Nosalva

•updated Aug 20, 2026•0•0•0

Detects HTTP GET requests to a specific Cloudflare Workers domain ('is-01-ast.ols-img-12.workers.dev') used for msaRAT WebRTC signaling, characterized by the presence of spoofed 'Origin' and 'Referer' headers pointing to 'microsoft.com' alongside a 'HeadlessChrome' user agent, indicating malicious command-and-control behavior.