Browser extensions have long occupied an uncomfortable middle ground in enterprise security — useful enough to be universally tolerated, yet opaque enough to evade meaningful scrutiny. A newly identified attack campaign is exploiting precisely that blind spot, turning a legitimate browser communication protocol into a launchpad for ransomware deployment.
A New Vector Hiding in Plain Sight
Security researchers have uncovered a malicious Microsoft Edge extension — internally tracked as Edgecution — that was actively weaponized in a ransomware intrusion. What makes this campaign technically notable isn't just the use of a rogue browser extension, but how it leverages Chrome's Native Messaging protocol to escape the browser sandbox entirely and communicate with a Python-based backdoor running at the host operating system level.
Native Messaging is a legitimate browser feature. It exists to allow extensions to communicate with locally installed desktop applications — think password managers that auto-fill credentials in a browser form. The protocol works by having the browser spawn the native application as a separate process and exchange data through standard input/output streams. It's functional, widely supported, and largely invisible to most users. That combination makes it an attractive abuse target for sophisticated threat actors.
The Attack Chain: Social Engineering Meets Technical Precision
The intrusion sequence begins not with a vulnerability exploit but with a phone call — or more precisely, a Microsoft Teams message. Attackers impersonating IT support staff directed employees to a fraudulent web page, framed as a routine spam filter installation. The fake portal was styled to mimic Microsoft's branding, presenting itself as an Outlook Updates Management Console.
From there, victims encountered multiple download options — each a different pathway to compromise. Researchers identified three distinct delivery mechanisms embedded in the page:
Clicking any button triggered the download of a ZIP archive fetched with deliberately malformed headers — a technique designed to prevent security tools from correctly identifying it as a valid compressed file. Inside, the archive contained an embedded Python 3.13.3 runtime and two directories labeled extension and native, providing a clear architectural blueprint of what followed.
Some buttons also copied commands directly to the clipboard or launched credential-harvesting forms requesting Microsoft 365 and Outlook passwords — broadening the attacker's potential return from each victim interaction.
Two Components, One Coordinated Threat
Edgecution operates through a two-part architecture that separates browser-level command execution from host-level impact:
Component One: The Malicious Extension
Disguised as an Edge Monitoring Agent, the rogue extension runs within a headless Edge browser instance, making it invisible to the end user. It connects to attacker-controlled command-and-control infrastructure, receives instructions, and relays results. However, because browser extensions are sandboxed, direct interaction with the underlying operating system is restricted.
Component Two: The Python Backdoor
This is where the Native Messaging bridge becomes critical. The malicious scripts install a Chrome native messaging manifest — a configuration file that formally registers a native application the browser is permitted to communicate with. When the extension invokes this registered host, it spawns the Python backdoor as a legitimate child process with full host-level access.
The backdoor's capability set is comprehensive:
- Execute arbitrary shell commands
- Run PowerShell scripts
- Execute dynamic Python code received from the C2
- Write files to the host filesystem
- Enumerate active processes
- Harvest system information
Researchers also noted that both components contain unused command handlers — dormant functionality that may be activated in future iterations of the malware, suggesting active development and iteration by the operators.
The browser sandbox was never designed to be a security perimeter — it was designed to contain web content. Edgecution is a reminder that when extensions can register native hosts, that containment assumption collapses.
Ransomware Connection and Threat Actor Profile
The campaign is attributed to an initial access broker (IAB) believed to be affiliated with the Payouts Kings ransomware operation. IABs specialize in gaining footholds in target networks and selling that access to ransomware affiliates — making Edgecution's persistence mechanisms particularly concerning. The scheduled task created during installation ensures the headless Edge process restarts reliably, maintaining the attacker's channel into the compromised environment across reboots.
What You Should Do
This attack surface is manageable, but only with deliberate policy enforcement. Security teams should prioritize the following actions:
- Audit and restrict browser extension installations. Enterprise browsers should enforce allowlisting policies that prevent unauthorized extensions from being installed, particularly those claiming to be monitoring or administrative agents.
- Lock down Native Messaging host registrations. Review and restrict which native applications are permitted to register as Native Messaging hosts via Group Policy or endpoint configuration management. Most employees have no legitimate need for custom native hosts.
- Monitor headless browser processes. Edge or Chrome running without a visible window is anomalous in most enterprise environments. Endpoint detection rules should flag and alert on headless browser execution.
- Train employees on Teams-based social engineering. The initial vector here is human, not technical. Employees should be conditioned to verify IT requests through independent channels before executing any downloaded scripts or installers.
- Investigate Python runtime deployments. Bundled Python environments appearing outside of approved development toolchains are a strong signal of malicious activity. Monitor for unexpected Python interpreter processes and file drops.
- Hunt using published indicators of compromise. Update detection tooling with the relevant C2 addresses, file hashes, and extension identifiers associated with this campaign.
The Broader Implication
What Edgecution demonstrates most clearly is that ransomware operators and their access broker partners are investing in technical sophistication at the delivery layer. Abusing a legitimate, well-documented browser API to achieve sandbox escape is not the work of a commodity threat actor — it reflects a deliberate effort to find seams in enterprise security architectures that defenders haven't historically monitored closely.
Browser extensions remain one of the least scrutinized attack surfaces in most organizations. If this campaign achieves nothing else, it should prompt security leaders to treat the enterprise browser as exactly what it is: a powerful, persistent, network-connected application running with user-level trust — and govern it accordingly.
