Chaos Ransomware - Headless Browser Launch for CDP Hijacking

Georg Lauenstein@gsec

•updated 10 days ago•1•0•3

Detects Chrome or Edge being launched in headless mode with the remote debugging port flag enabled. msaRAT (Chaos ransomware) uses this to spawn a hidden browser instance it then manipulates via Chrome DevTools Protocol (CDP) to inject JavaScript, hijack browser functionality, and build a covert WebRTC C2 channel that never touches the network directly from the malware process.