Edgecution uses – A malicious Microsoft Edge extension dubbed “Edgecution” has been tied to ransomware activity, using Chrome Native Messaging to escape the browser sandbox and deploy a Python-based backdoor. The attack chain starts with a Teams impersonation and a fake Microso
For many employees, the instruction looks routine: install a “spam filter update,” click a download button, move on with the day. For the attackers behind “Edgecution,” that moment is where the real work begins.
A malicious Microsoft Edge extension with that name has been used in a ransomware attack to escape the browser sandbox and deploy a Python-based backdoor. The escape hinges on a trick that turns a browser feature into a bridge to the underlying desktop: the attacker leverages the Chrome Native Messaging protocol. which lets browser extensions communicate with native applications—such as a password manager—so the extension can fill web forms.
In Edgecution’s case. that same capability is used to launch a native application as a separate process and communicate with it over standard input/output data streams. The extension is still limited by the browser sandbox on its own. The attacker’s answer is a second payload: a host-level executor implemented as a Python-based backdoor that receives commands relayed from the malicious extension.
The compromise reportedly follows a familiar social engineering path. The attacker poses as IT support personnel on Microsoft Teams and directs employees to a fraudulent page under the pretense of installing a spam filter update. From there. the victim encounters a fake Microsoft “Outlook Updates Management Console. ” where download buttons for “update packs” or “software verification” offer multiple ways to execute the next stage.
Researchers at cloud security company Zscaler believe Edgecution is deployed by an initial access broker (IAB) connected to the Payouts Kings ransomware operation. In attacks using tactics previously associated with the IAB. the threat actor directs victims to that fake Microsoft console and then uses the buttons to deliver malicious components. Depending on what the victim clicks. the results can include copied scripts to the clipboard. the launch of forms requesting Microsoft 365 and Outlook passwords. or direct downloading of components that move the chain forward.
The buttons themselves are wired to three different options—via an AutoHotKey script. a Windows batch script. and PowerShell script—to deploy Edgecution malware. Zscaler explains that when the AutoHotKey script or clipboard content is executed. the commands configure the environment. fix the encrypted ZIP file headers. extract relevant files. and create a scheduled task that executes Microsoft Edge.
The malicious components are fetched from the fake Microsoft update site inside a ZIP archive delivered with malformed headers. a detail meant to prevent security products from recognizing it as a valid archive. Within that ZIP file. Zscaler reports. there is an embedded Python version 3.13.3 and two directories named “extension” and “native. ” offering a roadmap to what each part is meant to do.
One component is the malicious Microsoft Edge extension disguised as an “Edge Monitoring Agent.” It connects to the attacker’s command-and-control (C2) endpoint. receives instructions for execution. and sends results back to the operator. Edgecution then runs in a headless Edge browser, keeping the activity out of the user’s view. At that point, the extension still needs a way to act beyond the browser. That’s where the Python-based backdoor steps in.
Zscaler describes the Python backdoor as the host-level executor that can be instructed through commands relayed from the extension. The backdoor potentially supports jobs including executing shell commands. running PowerShell. running arbitrary Python code. writing files on the host. enumerating running processes. and gathering system information.
The scripts’ role is to let the extension launch the Python backdoor. Zscaler says this is achieved by creating—in the native directory—a batch file the extension can invoke. The attacker also creates the required Chrome native messaging manifest that describes how the browser can connect to the native app.
Zscaler’s technical analysis adds another warning sign for defenders: both malware components include some unused commands that could be activated in future versions.
What makes Edgecution stand out is how deliberately it turns security assumptions into a workaround. The extension itself is confined to the browser sandbox. yet the attacker uses Native Messaging plus a Python host-level payload to move past that boundary. Zscaler warns that the method “illustrates the evolving sophistication” of threat actors tied to ransomware operations and can help them establish persistence on compromised hosts.
To fight back, Zscaler recommends strengthening monitoring of browser extensions and enforcing strict controls over native messaging host configurations. The company also provides a list of indicators of compromise (IoCs). including command-and-control servers used by Edgecution and hashes for the malicious extension and the Python backdoor.
Edgecution Microsoft Edge extension ransomware Payouts Kings Chrome Native Messaging Python backdoor cloud security Zscaler Microsoft Teams phishing native messaging host scheduled task Indicators of Compromise