The "Edgecution" malware is a malicious Microsoft Edge extension that exploits the Chrome Native Messaging protocol to escape the browser sandbox and deploy a Python-based backdoor, facilitating ransomware deployment. The attack vector involves social engineering via Microsoft Teams, where attackers impersonate IT support to trick users into downloading malicious components. The malware evades detection using a malformed ZIP archive containing an embedded Python interpreter and the malicious extension disguised as an Edge Monitoring Agent.
Malware New ‘Edgecution’ malware uses browser extension to deploy ransomware June 25, 2026 Share By SC Staff (Adobe Stock) Per Bleeping Computer, a new malicious Microsoft Edge extension named "Edgecution" has been identified by Zscaler, capable of escaping browser sandboxes and deploying a Python-based backdoor, facilitating ransomware attacks. The Edgecution malware exploits the Chrome Native Messaging protocol to enable communication between browser extensions and native desktop applications. Attackers impersonate IT support on Microsoft Teams, directing employees to a fake page under the guise of a spam filter update. This leads to the download of malicious components, including scripts that deploy the Edgecution malware. Researchers at Zscaler believe this is orchestrated by an initial access broker linked to the Payouts Kings ransomware operation. The malware uses a malformed ZIP archive to evade security detection, containing an embedded Python version and components for a malicious Edge extension and a native backdoor. The extension, disguised as an Edge Monitoring Agent, connects to a command-and-control server. To bypass the browser sandbox, it leverages a Python backdoor that executes commands on the host system, such as running shell commands, PowerShell, or gathering system information. Source: Bleeping Computer SC Staff Related Malware StealC infrastructure takedown assisted by AI analysis, C2 infiltration Laura French June 25, 2026 Microsoft, Proofpoint, IBM, Europol and other partners took aim the StealC and Amadey “assembly line.” Ransomware Attackers drop DragonForce ransomware leveraging MS Teams relay systems Steve Zurier June 17, 2026 DragonForce ransomware abused Microsoft Teams relay infrastructure to hide C2 traffic. Malware SprySOCKS backdoor expands to Windows with new variants SC Staff June 16, 2026 The Windows variants, WIN_DRV and WIN_PLUS, retain the core architecture of their Linux predecessor, including command-and-control (C2) protocols and encryption methods. Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Adware You can skip this ad in 5 seconds