CDP Runtime.evaluate injecting msaRAT WebRTC DataChannel JS payload

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•1

Detects network traffic patterns associated with the msaRAT remote access trojan, specifically identifying suspicious WebRTC DataChannel creation, binary data handling, and custom window messaging bindings used for command-and-control communication.