India, July 24 -- Chrome is usually trusted because it is familiar. Chaos ransomware is turning that assumption into cover. Cisco Talos has identified a Rust based remote access trojan called msaRAT that uses Google Chrome or Microsoft Edge as its external command channel. The malware itself does not connect directly to attacker infrastructure. Instead, it controls a hidden browser session which handles the network traffic on its behalf.

That separation can make an intrusion harder to spot. Endpoint tools may see the malware communicating only with the local machine while network monitoring records traffic from a legitimate browser.

The attack occurs after a system has already been compromised but before ransomware is deployed. Attacker...