🤚 The Open-Palm Installation

If you’ve ever wondered what the most elaborate way to get ransomware onto a corporate network might be, Zscaler has your answer: build a malicious Microsoft Edge extension, name it “Edgecution,” disguise it as an “Edge Monitoring Agent,” abuse Chrome’s own Native Messaging protocol to escape the browser sandbox, and deploy a Python-based backdoor that can run shell commands, execute PowerShell, write files, and enumerate processes — all while the browser sits there, headless and invisible, like a very well-dressed accomplice.

The attack, linked to an initial access broker associated with the Payouts Kings ransomware operation, begins not with a sophisticated exploit but with the most depressingly effective technique in cybersecurity: someone pretending to be IT support on Microsoft Teams.

👐 The Two-Handed Social Engineering

The kill chain is, if nothing else, architecturally impressive. It unfolds like this:

• Step 1: Attackers impersonate IT support on Microsoft Teams and direct employees to a fraudulent page presenting itself as the “Outlook Updates Management Console” — a thing that does not exist but sounds exactly like something that would
• Step 2: The page offers a download button that deploys malicious components through AutoHotKey scripts, batch files, or PowerShell commands — because variety is the spice of initial access
• Step 3: The payload arrives in a ZIP archive with deliberately malformed headers to evade security detection, containing Python 3.13.3 alongside two directories labeled, with the subtlety of a burglar wearing a nametag, extension and native
• Step 4: The extension installs itself in Edge, runs in headless mode (invisible to the user), connects to a command-and-control server, and begins accepting instructions

But here’s where it gets clever. Browser extensions live in a sandbox. They cannot touch the operating system. They are, by design, prisoners in a very comfortable cell. Edgecution solved this by exploiting Chrome’s Native Messaging protocol — a legitimate feature that allows extensions to communicate with desktop applications. The malware creates a batch file in a native directory and registers a Chrome native messaging manifest, establishing a perfectly legitimate communication channel between the browser and the host operating system.

The browser sandbox was not bypassed. It was not broken. It was politely asked to open the door using the mechanism the browser itself provides.

🌿 The Gentle Awakening

There is a certain poetry in the fact that the feature designed to let extensions talk to legitimate desktop applications has been repurposed to let extensions install ransomware. Native Messaging exists because sometimes your password manager needs to communicate with the browser, or your corporate security tool needs to relay data. It is a bridge between two worlds, and like all bridges, it works equally well in both directions.

Zscaler noted that the backdoor contains “unused commands” — capabilities built into the malware that haven’t been activated yet. This is the cybercriminal equivalent of building a kitchen renovation with extra outlets “for later.” The Payouts Kings operation is not done. This is version one.

The Python-based backdoor itself is a Swiss Army knife of post-compromise capability: shell commands, PowerShell execution, arbitrary Python code, file writing, process enumeration, and system information gathering. Once it’s on the host, the attacker has more control over your workstation than your IT department does — and unlike your IT department, it responds to tickets instantly.

👑 The Gold-Leaf Extension Policy

Your organization’s browser extension policy is almost certainly one of the following: “allow all,” “we have a policy but nobody follows it,” or “we blocked extensions once and the CEO called within the hour.” Edgecution is a case study in why the third option is the correct one, and why the CEO should be told, respectfully, that the “Edge Monitoring Agent” they approved is monitoring them right back.

The attack surface here is not a vulnerability. It is a feature. Native Messaging works exactly as documented. The browser sandbox works exactly as designed. The only thing that failed was the assumption that a feature designed for trusted applications would only be used by trusted applications — an assumption that, in 2026, qualifies as either optimism or negligence, depending on your insurance provider.

Microsoft Teams, Microsoft Edge, Chrome’s Native Messaging protocol, a Python runtime, and a ZIP file with bad headers. Every component is legitimate. Every tool is off-the-shelf. The only custom work was the audacity.

“The browser extension asked to talk to the desktop. The desktop said yes. The ransomware said thank you. Nobody in this chain did anything wrong except trust each other.” — The Slap of Wisdom Browser Security Desk, disabling extensions from a computer that no longer has any, just to be safe