Headless Chrome/Edge process making external network connections (browser-proxied C2)

Emiliano Mema@Nosalva

•updated Aug 20, 2026•0•0•0

Detects outbound network connections initiated by a process identifying itself as 'HeadlessChrome' within the User-Agent string. This behavior is indicative of a headless browser being misused as a proxy for Command and Control (C2) communication, as observed in msaRAT infections.