msaRAT CDP Injection via Page.setBypassCSP and msa* Bindings

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•4

Detects anomalous network connections to the local Chrome DevTools Protocol (CDP) debugging interface (127.0.0.1) associated with suspicious commands or function calls. This pattern is indicative of msaRAT malware attempting to perform process injection, bypass Content Security Policy (CSP), or execute code within a target browser process.