Bottom Line: A malicious Edge extension exploits the native messaging protocol to bypass browser sandbox and establish full remote access backdoor at operating system level.
Security researchers from Zscaler have documented a malware campaign using a manipulated Microsoft Edge extension named Edgecution to install a Python-based backdoor on infected systems, serving as an entry point for ransomware attacks.
The attack chain begins with social engineering via Microsoft Teams, where attackers pose as IT support staff and direct employees to a fake Outlook updates administration console. Through three offered buttons, users can execute AutoHotKey, Batch or PowerShell scripts that download a manipulated ZIP archive. The archive contains an embedded Python version 3.13.3, the Edge extension and additional components, and is obscured from standard security software through manipulated header signatures.
The technical peculiarity lies in bypassing the browser sandbox: the malicious extension is initially isolated, but uses Chrome’s native messaging protocol – originally intended for communication between browser add-ons and local applications such as password managers – to launch and control a Python-based backdoor at operating system level. The locally running scripts automatically create the necessary manifest files so the browser accepts the connection to the native application.
Through this backdoor, attackers can execute shell commands and PowerShell scripts, load arbitrary Python code, write files, enumerate active processes and gather system information. According to Zscaler analysis, the infrastructure is operated by an Initial Access Broker with connections to the ransomware group Payouts Kings. The model aims to gain persistent access to corporate networks to prepare for subsequent encryption attacks.
Zscaler recommends CISOs subject browser extensions to stricter monitoring and regulate native messaging configurations on endpoints to close these exploitation vectors.
Source: www.it-daily.net · Published June 25, 2026
Lumi AI News — AI-assisted curation pursuant to Article 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.7.1.