Edgecution malware uses a malicious Microsoft Edge extension to escape the browser sandbox and deploy a Python-based backdoor. Researchers say the campaign combines social engineering with Chrome’s Native Messaging protocol to gain direct access to Windows systems. The attack allows cybercriminals to move beyond browser restrictions and establish long-term access. It also demonstrates how ransomware-linked threat actors continue refining their techniques.
Fake Microsoft Update Lures Victims
Researchers at Zscaler uncovered the campaign while investigating activity linked to an initial access broker believed to support the Payouts Kings ransomware operation.
The attack begins with cybercriminals impersonating IT support staff through Microsoft Teams. They direct employees to a fake Microsoft webpage that claims to provide a spam filter or Outlook update.
The fraudulent site offers several download options, including AutoHotKey, Windows batch, and PowerShell scripts. Each option prepares the victim’s device for malware installation.
Some buttons copy malicious commands directly to the clipboard. Others download additional files or prompt users to enter Microsoft 365 and Outlook credentials.
Edge Extension Bypasses Browser Security
The downloaded archive contains an embedded Python 3.13.3 environment and two directories named extension and native. These components form the foundation of the attack.
The first component is a malicious Microsoft Edge extension disguised as an Edge Monitoring Agent. It connects to a remote command-and-control server, receives instructions, executes browser-based tasks, and returns the results to the attackers.
Normally, browser extensions remain inside the browser sandbox. This limits their interaction with the operating system. Edgecution avoids that restriction by abusing Chrome’s Native Messaging protocol.
Native Messaging is a legitimate browser feature. It allows extensions to communicate with trusted desktop applications, such as password managers. In this campaign, attackers use it to launch their own malicious application outside the browser.
Python Backdoor Gives Attackers Full Control
The second component is a Python-based backdoor that runs directly on the host system.
The malicious extension forwards commands through the Native Messaging channel. The Python backdoor receives those instructions and executes them outside the browser environment.
Researchers found that the malware can:
- Execute shell commands
- Run PowerShell commands
- Execute arbitrary Python code
- Write files to the compromised device
- Enumerate running processes
- Collect system information
Supporting scripts create the batch file that launches the backdoor. They also generate the Native Messaging manifest required for communication between Microsoft Edge and the local application.
Together, these components transform a browser extension into a bridge that provides attackers with system-level access.
Attackers Continue Refining Their Techniques
Zscaler found several unused functions within the malware. These features could appear in future versions of the campaign.
Researchers believe the operation reflects the growing sophistication of ransomware-linked initial access brokers. These groups continue developing new methods to establish persistence before ransomware deployment begins.
The attackers also run the extension inside a headless Microsoft Edge browser. This approach helps conceal malicious activity from the victim.
Organizations Should Tighten Browser Security
The campaign shows how legitimate browser features can become powerful attack tools when abused.
Zscaler recommends monitoring browser extensions more closely and limiting Native Messaging where possible. Organizations should also review Native Messaging host configurations and investigate unexpected changes.
Security teams should compare their environments against the published indicators of compromise. These include command-and-control infrastructure, malicious extension hashes, and Python backdoor artifacts. Early detection can prevent attackers from gaining long-term access.
Conclusion
Edgecution malware demonstrates how cybercriminals continue combining legitimate Windows features with advanced social engineering to compromise organizations. By abusing Chrome’s Native Messaging protocol, attackers bypass normal browser protections and establish persistent access through a Python backdoor. Organizations that strengthen browser security, monitor extensions, and restrict Native Messaging will be better prepared to detect similar attacks before they develop into ransomware incidents.
0 responses to “Edgecution Malware Uses Edge Extension to Deploy Backdoor”