Payouts King Initial Access Broker Deploys Edgecution Malware Through Malicious Edge Extension

Gbhackers •Mayura Kathir • June 24, 2026

A concerted campaign by an initial access broker with ties to the Payouts King ransomware ecosystem that leverages a novel browser-based delivery technique to establish persistent host-level control. The actor deploys a malicious Microsoft Edge extension dubbed “Edgecution” which abuses the Chrome native messaging protocol to reach a Python backdoor running on the endpoint, effectively […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Payouts King Ransomware Uses Edgecution Malware via Malicious Edge Extension A new ransomware campaign linked to the Payouts King group employs a malicious Microsoft Edge extension called 'Edgecution' to exploit the Chrome native messaging protocol. This attack allows the malware to escape the browser sandbox and gain access to the victim's local system. The initial access is achieved through social engineering tactics, where attackers impersonate IT staff on Microsoft Teams, directing victims to a fraudulent Microsoft site. Victims are prompted to download malicious components disguised as software updates, which include scripts for deploying the malware. The Edgecution malware consists of a browser extension and a Python-based backdoor that enables remote command execution. This campaign poses a significant risk to organizations using Microsoft Edge, as it can lead to unauthorized access and data breaches. Researchers from Zscaler and BleepingComputer have identified the attack vectors and provided insights into the malware's operation. 7 sources 71

Extracted Entities

Payouts King Initial Access Broker Deploys Edgecution Malware Through Malicious Edge Extension

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Ransomware Groups (1)