Payouts King Ransomware Uses Edgecution Malware via Malicious Edge Extension

• •The Edgecution malware exploits the Chrome native messaging protocol to bypass browser security.
• •Attackers impersonate IT personnel to trick users into downloading malicious software.
• •The campaign is linked to the Payouts King ransomware group, indicating a targeted threat.

A new ransomware campaign linked to the Payouts King group employs a malicious Microsoft Edge extension called 'Edgecution' to exploit the Chrome native messaging protocol. This attack allows the malware to escape the browser sandbox and gain access to the victim's local system. The initial access is achieved through social engineering tactics, where attackers impersonate IT staff on Microsoft Teams, directing victims to a fraudulent Microsoft site. Victims are prompted to download malicious components disguised as software updates, which include scripts for deploying the malware. The Edgecution malware consists of a browser extension and a Python-based backdoor that enables remote command execution. This campaign poses a significant risk to organizations using Microsoft Edge, as it can lead to unauthorized access and data breaches. Researchers from Zscaler and BleepingComputer have identified the attack vectors and provided insights into the malware's operation.