One way hackers adapt is by twisting legitimate features into tools for harm. A recent example shows a malicious Microsoft Edge extension escaping the browser’s restricted environment to establish persistent access on infected systems.  Researchers named the campaign Edgecution, which abuses built-in browser functionality rather than software flaws. The payload deploys a Python-based backdoor capable of silently executing commands on compromised devices. Researchers at Zscaler believe the campaign is linked to an Initial Access Broker associated with the Payouts Kings ransomware operation.  Instead of exploiting vulnerabilities, the attackers rely on social engineering and legitimate browser capabilities to gain deeper access to victim systems. The attack begins with someone impersonating IT support on Microsoft Teams, directing employees to a fake Microsoft update page under the pretense of installing an email security update.  Victims see what appears to be an official Outlook update portal, but clicking its buttons instead downloads malware, copies malicious scripts to the clipboard, or requests Microsoft 365 and Outlook credentials. What looks like a routine update quickly turns into a compromise. The downloaded package contains intentionally malformed ZIP headers to evade security scanners.  Once executed, scripts repair the archive, extract hidden files, configure the system, and create scheduled tasks that silently launch Microsoft Edge in the background. Inside the package are two main components: a malicious Microsoft Edge extension disguised as an Edge Monitoring Agent and a Python-based backdoor. The extension communicates with attacker-controlled servers, receiving commands and sending back results.  Although browser extensions normally operate inside isolated sandboxes, this attack bypasses those restrictions. Attackers abuse Chrome’s Native Messaging protocol—a legitimate feature that allows browser extensions to communicate with trusted desktop applications. By leveraging this mechanism, the malicious extension launches the bundled Python backdoor as a native application, escaping the browser’s security boundaries.   Once active, the Python backdoor enables attackers to execute shell commands, run PowerShell and arbitrary Python code, write files, enumerate running processes, and collect system information. Helper scripts generate the Native Messaging manifest and batch files needed to connect the extension with the local application.  The malicious extension runs inside a headless Microsoft Edge session, remaining invisible to users while maintaining persistent access that is difficult to detect. Zscaler also identified unused commands within both malware components, indicating the framework is still under development and could gain additional capabilities in future versions.  According to researchers, Edgecution highlights the growing sophistication of ransomware campaigns. Rather than relying solely on traditional malware, attackers increasingly exploit trusted browser features and enterprise collaboration platforms to bypass security defenses.  To reduce the risk, organizations should closely monitor browser extensions, restrict Chrome Native Messaging where possible, review native messaging host configurations, and train employees to recognize social engineering attempts delivered through platforms such as Microsoft Teams. Zscaler has also published indicators of compromise, including malicious extension hashes and command-and-control servers, to help defenders identify affected systems.

eSentire TRU reported a July 2026 phishing campaign attributed to UNC6692 that used email bombing, Microsoft Teams impersonation, Quick Assist, and a phishing site to deliver the Edgecution malicious browser extension to a software industry victim. Edgecution abused a Microsoft Edge extension plus a native messaging host to monitor targeted websites, steal credentials, and execute commands on the host system. #UNC6692 #Edgecution #MicrosoftEdge #MicrosoftTeams

A malicious Microsoft Edge extension called Edgecution was used in a ransomware-related attack to escape the browser sandbox and deploy a Python-based backdoor. The campaign relied on fake Microsoft support pages, Chrome Native Messaging, and a disguised Edge Monitoring Agent to run commands and maintain persistence. #Edgecution #PayoutsKings #MicrosoftEdge #MicrosoftTeams #OutlookUpdatesManagementConsole

Zscaler ThreatLabz tracked Edgecution, a malicious Microsoft Edge extension used by an initial access broker tied to Payouts King ransomware to deliver a Python backdoor through Chrome native messaging. The campaign used fake Microsoft/Outlook update pages, social engineering via Microsoft Teams, and CloudFront-hosted C2 infrastructure to install the extension, evade detection, and execute commands on victim systems. #PayoutsKing #Edgecution #MicrosoftEdge #MicrosoftTeams #CloudFront

A malicious Microsoft Edge extension dubbed 'Edgecution' has been used in a ransomware attack to escape the browser sandbox and deploy a Python-based backdoor.

A malicious Microsoft Edge extension dubbed 'Edgecution' has been used in a ransomware attack to escape the browser sandbox and deploy a Python-based backdoor. [...]

Introduction: A Quiet Attack Chain Built on Human Trust Cybersecurity researchers are warning about a sophisticated threat campaign linked to the activity cluster tracked as UNC6692, where attackers combined email bombing, Microsoft Teams impersonation, Quick Assist abuse, and a malicious Microsoft Edge extension to compromise software environments. The operation highlights a growing trend in modern cyberattacks: criminals are no longer relying only on technical exploits.

Introduction: When a Browser Becomes the Modern cybercriminals are no longer relying solely on malicious downloads or obvious phishing emails. Instead, they are exploiting trusted tools that employees use every day. One of the latest examples is Edgecution, a sophisticated malware framework that transforms Microsoft Edge from a productivity tool into a stealthy attack platform. What makes this threat particularly alarming is its ability to escape the traditional security boundaries of the browser.

A malicious Microsoft Edge extension dubbed ‘Edgecution' has been used in a ransomware attack to escape the browser sandbox and deploy a Python-based backdoor. Access to the local system is obtained b...

Threat actors linked to the Payouts King ransomware operations are using a novel malware-delivery mechanism to compromise

Edgecution uses - A malicious Microsoft Edge extension dubbed “Edgecution” has been tied to ransomware activity, using Chrome Native Messaging to escape Stay updated with the latest global news from MISRYOUM.

The Edgecution malware exploits the Chrome Native Messaging protocol to enable communication between browser extensions and native desktop applications.

A malicious Microsoft Edge extension dubbed 'Edgecution' has been used in a ransomware attack to escape the browser sandbox and deploy a Python-based backdoor.

Microsoft Edge users are facing a severe new security threat. Security researchers at Zscaler have uncovered a malicious browser extension dubbed Edgecution that secretly installs itself on your computer, bypassing normal security measures to pave the way for a devastating ransomware attack. The scariest part about this new malware? You won’t even know it is [...] The post New ‘Edgecution’ malware silently hijacks Microsoft Edge to deploy ransomware appeared first on PiunikaWeb .