Loading malware…
Edgecution is a Windows-focused malware framework built around a malicious Microsoft Edge extension paired with a Python-based native messaging host that functions as a host-level backdoor. It has been linked to initial access activity associated with the Payouts King ransomware ecosystem and has also been reported in activity attributed to UNC6692. The malware is notable for abusing the Chrome Native Messaging protocol to bridge from a browser extension into native code execution on the host, effectively escaping normal browser sandbox constraints without relying on a browser exploit.
Edgecution is typically delivered through social engineering campaigns that impersonate internal IT support, especially via Microsoft Teams. Victims are lured to fraudulent Microsoft-themed update or management pages and prompted to run deployment scripts or remote-assistance workflows. Reported delivery chains include fake software or spam-filter update pretexts, phishing pages that also harvest Microsoft 365 credentials, and staging through AutoHotKey, batch, PowerShell, or Quick Assist-assisted execution.
The malware uses a two-component architecture. The Edge extension establishes command-and-control communications over WebSockets and relays commands through Native Messaging to a Python backdoor running on the host. The Python component provides the primary malicious functionality, including host and user fingerprinting, system information collection, filesystem access, arbitrary command execution, PowerShell execution, Python execution, file writing, and process enumeration. Some reporting also indicates browser-side monitoring logic for targeted URLs or keywords, although this appears secondary to the host backdoor capability.
Edgecution is designed for stealth and persistence. Deployment scripts create a separate Edge profile, register a native messaging host, and launch Edge in a hidden or headless mode so the malicious extension is not visible in the user’s normal browsing session. Persistence has been established through scheduled tasks, and the staging components may delete themselves after execution. The malware has also shown adaptation to endpoint security products by altering Edge launch behavior when certain EDR tools are present.
The overall tradecraft indicates use as an initial access and post-compromise foothold for follow-on ransomware operations. By combining browser-based social engineering with host-level execution, Edgecution gives operators a durable and covert bridge from user interaction to full system control on compromised Windows endpoints.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Further investigation into the attack revealed an attempt to deploy Edgecution, a malicious browser extension masquerading as "Edge Monitoring Agent." Acting as a backdoor, Edgecution gives operators extensive control over the victim's Microsoft Edge browser and host system.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
The final button in the page " Updates Registration " is utilized by the threat actors to capture the victim's Office 365 password.
The scripts repair a malformed ZIP archive, extract its files, configure a malicious Edge profile, and create a scheduled task that starts Microsoft Edge in headless mode.
Creates a Scheduled Task with description " Автозапуск {1dabdc99-69e0-45a6-9298-529419fa2fed} " configured to launch Microsoft Edge and load the Edgecution extension.
enables capabilities such as: arbitrary shell command execution, Python and PowerShell script execution
Arbitrary powershell commands (command 7) get wrapped into the command line shown in the next figure.
Zscaler describes three deployment options from the fake update page: an AutoHotKey script, a Windows batch script copied to the clipboard, and a PowerShell script copied to the clipboard.
enables capabilities such as: arbitrary shell command execution, Python and PowerShell script execution
The native messaging host component of Edgecution is critical and acts as the bridge between the Microsoft Edge extension and the underlying victim's host operating system.
The victim was instructed to launch Quick Assist and grant the threat actors access. Once connected, threat actors navigated to an Amazon S3-hosted phishing site and downloaded AutoHotkey along with a malicious AutoHotkey script, which was then executed to install Edgecution.
The scripts repair a malformed ZIP archive, extract its files, configure a malicious Edge profile, and create a scheduled task that starts Microsoft Edge in headless mode.
Creates a Scheduled Task with description " Автозапуск {1dabdc99-69e0-45a6-9298-529419fa2fed} " configured to launch Microsoft Edge and load the Edgecution extension.
The final button in the page " Updates Registration " is utilized by the threat actors to capture the victim's Office 365 password.
The scripts repair a malformed ZIP archive, extract its files, configure a malicious Edge profile, and create a scheduled task that starts Microsoft Edge in headless mode.
All strings in the stager are obfuscated by a single-byte XOR routine... The file in question was obfuscated through the free JavaScript obfuscation service Obfuscator.io.
attempt to deploy Edgecution, a malicious browser extension masquerading as "Edge Monitoring Agent."
Post-compromise activity frequently involved disabling endpoint security tools and harvesting credentials stored in browsers before ransomware deployment.
6 List running processes... Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,ExecutablePath,CommandLine
The extension side beacons to command-and-control infrastructure.
deobfuscating it reveals that it establishes a persistent WebSocket connection to the C2 server
This AutoHotkey script is the initial stager for Edgecution. It downloads a password-protected ZIP archive from AWS S3 containing Edgecution.
Multiple groups gained access by contacting employees via Microsoft Teams, posing as internal IT support, then guiding the target through a screen-sharing session to install a Remote Monitoring and Management (RMM) tool, such as AnyDesk/QuickAssist, or to execute a delivered payload.
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A browser backdoor deployed via social-engineering-led initial access activity using Microsoft Teams impersonation and a forged software-update console.
A malicious Microsoft Edge extension paired with a Python-based native messaging host that escapes the browser sandbox to provide persistent backdoor access. It monitors visits to targeted websites in real time, communicates with C2 over WebSocket, fingerprints hosts, enumerates processes, writes files, and executes arbitrary shell, Python, and PowerShell commands on compromised machines.
A malicious Microsoft Edge browser-extension-based malware used in Teams phishing campaigns. It abuses the Chrome native messaging protocol to escape normal browser constraints, gain host access, manipulate the local filesystem, launch processes, and execute arbitrary code on the compromised system.
Malicious Microsoft Edge extension that abuses Chrome Native Messaging to communicate with a native Python-based backdoor on the host, bypass browser sandbox restrictions, connect to C2 infrastructure, and execute commands such as shell and PowerShell commands while collecting system information.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.