A malicious Microsoft Edge extension, named 'Edgecution,' was used to deploy ransomware. The attackers employed the Chrome Native Messaging protocol to bypass browser security features.

The deployment involved an initial access broker linked to the Payouts Kings ransomware operation, according to researchers at cloud security company Zscaler. Attackers posed as IT support personnel on Microsoft Teams, directing employees to a fraudulent webpage under the guise of installing a spam filter update.

Victims were sent to a fake Microsoft 'Outlook Updates Management Console' that offered download buttons for update packs or software verification. Initiating a download from this fake site resulted in malicious components being installed, scripts being copied to the clipboard, or forms requesting Microsoft 365 and Outlook passwords being launched.

Zscaler stated, "These buttons offer the threat actor three different options (via an AutoHotKey script, Windows batch script, and PowerShell script) to deploy the Edgecution malware." Malware components were retrieved from the fake update site inside a ZIP archive that featured malformed headers, designed to prevent security products from recognizing it as a valid archive.

The ZIP file contained an embedded Python version 3.13.3 and two directories labeled 'extension' and 'native.' The first malicious component was an Edge extension disguised as an Edge Monitoring Agent. This malicious extension connected to the attacker's command-and-control endpoint, received execution instructions, and transmitted results back to the operator.

The Edgecution malware operated within a headless Edge browser and utilized Chrome's Native Messaging protocol to communicate with a local application to overcome browser sandbox limitations. This protocol enables a browser to launch a native application as a separate process and communicate using standard input/output data streams.

A second malware component, a Python-based backdoor, functioned as the host-level executor. This Python backdoor received commands relayed from the malicious extension. The Python backdoor was capable of executing shell commands, running PowerShell, running arbitrary Python code, writing files on the host, enumerating running processes, and gathering system information.

Zscaler stated, "When the AutoHotKey script or clipboard content is executed, the commands will configure the environment, fix the encrypted ZIP file headers, extract relevant files, and create a scheduled task that executes Microsoft Edge." Scripts also created a batch file in the native directory for the extension to invoke and generated a Chrome native messaging manifest.

Zscaler's technical analysis indicated that both malware components contained unused commands that could be activated in future versions. Researchers warned that the method employed by Edgecution allows threat actors to establish persistence on compromised hosts. They recommended that organizations enhance monitoring of browser extensions and implement strict controls over native messaging host configurations.