msaRAT lets ransomware operators hide command-and-control traffic inside Chrome, using headless browsing, WebRTC, and TURN relays to make a malicious implant appear almost network-silent.