A newly identified version of the MsarAT remote access trojan (RAT) is using legitimate web browsers to disguise its command-and-control (C2) communications, making malicious traffic significantly harder to detect. By routing network activity through trusted applications such as Google Chrome and Microsoft Edge, the malware blends into normal user behavior and attempts to evade traditional security monitoring tools.
Researchers found that the latest MsarAT variant launches Chrome or Edge processes to proxy its communications with attacker-controlled infrastructure instead of establishing network connections directly. Because browsers routinely generate encrypted HTTPS traffic to numerous internet destinations, malicious communications routed through them can appear similar to legitimate web browsing, reducing the likelihood of triggering security alerts.
This technique represents an example of living-off-the-land tactics, where attackers abuse trusted software already installed on a system rather than introducing custom networking components that may be more easily identified by antivirus or endpoint detection solutions. By leveraging legitimate browser processes, the malware benefits from software that is digitally signed, commonly allowed through security policies, and expected to communicate with external networks.
MsarAT is a remote access trojan designed to provide attackers with persistent control over compromised systems. Once installed, it can execute commands, upload and download files, collect system information, capture credentials, deploy additional malware, and maintain long-term access for espionage or financially motivated attacks. Like many modern RATs, it is intended to operate quietly while avoiding detection for as long as possible.
Using browsers as communication proxies also complicates network analysis. Security tools that rely primarily on identifying suspicious processes making outbound connections may observe only legitimate browser activity, while the actual malware remains hidden behind inter-process communication. This makes behavioral detection, endpoint telemetry, and process relationship analysis increasingly important for identifying malicious activity.
The malware’s approach reflects a broader trend in cybercrime toward abusing legitimate applications rather than developing entirely custom tooling. Threat actors frequently leverage built-in operating system utilities, scripting engines, cloud storage services, collaboration platforms, and widely deployed applications to reduce their forensic footprint and blend into normal enterprise environments.
To defend against these techniques, organizations should implement endpoint detection and response (EDR) solutions capable of monitoring process behavior rather than relying solely on network signatures. Security teams should look for unusual parent-child process relationships, browsers launched by unexpected applications, abnormal command-line arguments, unexpected browser automation, and outbound connections that deviate from established user behavior.
Additional defensive measures include enforcing application control policies, restricting unnecessary scripting capabilities, implementing least-privilege access, monitoring persistence mechanisms, and ensuring systems remain fully patched. Threat hunting focused on process ancestry and endpoint behavior is becoming increasingly valuable as malware authors adopt more sophisticated evasion techniques.
The emergence of browser-assisted command-and-control demonstrates how attackers continue to adapt to modern security defenses. As endpoint protection improves, malware increasingly seeks to hide within legitimate software already trusted by users and organizations. Detecting these threats requires a combination of behavioral analytics, endpoint visibility, and continuous monitoring rather than relying exclusively on traditional signature-based detection methods.