XCSSET chrome_remote Backdoor Spawns Shell via exec.Command (Fileless Reverse Shell)

Duo Tech@duotech

•updated Jul 31, 2026•4•0•1

Detects the XCSSET chrome_remote backdoor spawning a shell via exec.Command in response to a console.log delimiter-prefixed command, implementing a fileless reverse shell over the CDP channel.