Back Feeds.4Sysops

Edgecution malware exploits browser native messaging to bypass sandboxes

Feeds.4Sysops •IT News • June 25, 2026

A new malware framework called Edgecution uses a malicious Microsoft Edge extension to establish a persistent foothold on Windows systems. Linked to an initial access broker for the Payouts King ransomware, the attack begins with social engineering messages on Microsoft Teams that impersonate IT support. Victims are directed to a fraudulent Outlook update page that delivers a payload containing a Python runtime and a malicious browser extension. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Payouts King Ransomware Uses Edgecution Malware via Malicious Edge Extension A new ransomware campaign linked to the Payouts King group employs a malicious Microsoft Edge extension called 'Edgecution' to exploit the Chrome native messaging protocol. This attack allows the malware to escape the browser sandbox and gain access to the victim's local system. The initial access is achieved through social engineering tactics, where attackers impersonate IT staff on Microsoft Teams, directing victims to a fraudulent Microsoft site. Victims are prompted to download malicious components disguised as software updates, which include scripts for deploying the malware. The Edgecution malware consists of a browser extension and a Python-based backdoor that enables remote command execution. This campaign poses a significant risk to organizations using Microsoft Edge, as it can lead to unauthorized access and data breaches. Researchers from Zscaler and BleepingComputer have identified the attack vectors and provided insights into the malware's operation. 7 sources 71

Extracted Entities

Edgecution malware exploits browser native messaging to bypass sandboxes

The full story

Extracted Entities

Attack Types (2)

Companies (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (2)

Ransomware Groups (1)

Tools (1)