Chaos ransomware group uses msaRAT to route traffic through headless browsers

The record

Written from the 2 reports below. Nothing here is unsourced.

Cisco Talos disclosed msaRAT, a new modular Rust implant deployed post-compromise by the Chaos ransomware gang, that routes command-and-control traffic through headless Chrome and Edge browsers on Windows.
Separately, researchers documented TELEPUZ, a ClickFix-distributed stealer with resilient fallback C2 channels embedded in Telegram, Steam, DNS, and blockchain smart contracts, alongside Vidar stealer modules.
Both campaigns highlight how threat actors are blending legitimate browser binaries and widely trusted services into their C2 chains to evade network and endpoint detection.
Organizations running Windows endpoints with Chrome or Edge installed are the primary affected population, particularly where browsers can be launched non-interactively with remote debugging flags.
Coverage from both The Hacker News stories is technical and disclosure-focused, with no visible attribution disputes — researchers are flagging novel TTPs rather than arguing over blame.
Defenders should watch for anomalous headless browser launches, unusual WebRTC or encrypted traffic from browser processes, and ClickFix-style pastejacking lures.
No public patches apply here; mitigations are behavioral and rely on endpoint telemetry and egress filtering.

Every report on this story, newest first. Times are when each outlet published.

Who is affected first and what likely follows, with a direction and a horizon. Extracted from the reports, never invented.

2 reports

English national2

All filed from IndiaSingle origin

Named in · :w-:w · Chrome · Chromium · Cloudflare · Edge · Google · Microsoft · Mozilla Firefox · Polygon · Steam · Telegram · Windows · Chaos

The 2 reports are listed beside the record.

Answers cite the reports above, or say they can't.