Ankura CTIX FLASH Update – July 24, 2026

Malware Activity

Browser-Based Evasion and GitHub Infrastructure Abuse Signal a New Era of Cyber Threats

Security researchers have uncovered two (2) highly sophisticated cyber campaigns that highlight how attackers are increasingly abusing trusted technologies to evade detection and expand their reach. In the first case, the Chaos ransomware group is using a newly identified malware called msaRAT, which routes its command-and-control (C2) communications through legitimate browsers like Google Chrome and Microsoft Edge using encrypted WebRTC connections and the Chrome DevTools Protocol. By disguising traffic as normal browser activity and leveraging trusted services such as Cloudflare Workers and Twilio TURN servers, the malware becomes significantly harder for traditional security tools to identify. Separately, researchers discovered a large-scale operation abusing compromised GitHub repositories and GitHub Actions runners to automatically scan for and exploit vulnerable cPanel