MalwareRansomware

Edgecution

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583.001DomainsEvidence1

All of the C2 servers observed by ThreatLabz have leveraged subdomains of cloudfront.net and hosted on Amazon Web Services (AWS).

Initial Access

1 technique

T1566.003Spearphishing via ServiceEvidence2

These attacks typically start via social engineering through Microsoft Teams messages that impersonate a company’s IT staff.

Execution

8 techniques

T1053.005Scheduled TaskEvidence2

the commands will configure the environment, fix the encrypted ZIP file headers, extract relevant files, and create a scheduled task that executes Microsoft Edge.

T1059Command and Scripting InterpreterEvidence2

1073Python BackdoorShell execute.

T1059.001PowerShellEvidence2

OS Version Verification Copies a PowerShell script to the clipboard that is used to set up and deploy the Edgecution malware.

T1059.003Windows Command ShellEvidence2

Outlook Version Verification Copies a Windows batch script to the clipboard that is used to set up and deploy the Edgecution malware.

T1059.006PythonEvidence2

the native directory contains a single obfuscated Python script... the Python backdoor can directly access the victim’s filesystem, execute arbitrary commands, create processes, etc.

T1106Native APIEvidence2

the Edgecution browser extension uses the Chrome native messaging protocol to invoke a Python backdoor that can directly access the victim’s filesystem, execute arbitrary commands, create processes, etc.

T1204User ExecutionEvidence1

When the AutoHotKey script or clipboard content is executed, the commands will configure the environment, fix the encrypted ZIP file headers, extract relevant files, and create a scheduled task that executes Microsoft Edge.

T1204.002Malicious FileEvidence1

Updates Pack 5029 DownloadDownloads an obfuscated AutoHotKey script... Updates Pack 5029-2 DownloadDownloads a legitimate AutoHotKey executable... When the AutoHotKey script or clipboard content is executed...

Persistence

3 techniques

T1053.005Scheduled TaskEvidence2

the commands will configure the environment, fix the encrypted ZIP file headers, extract relevant files, and create a scheduled task that executes Microsoft Edge.

T1112Modify RegistryEvidence2

the set up scripts set a value named AppKey in the Windows registry under HKCU\SOFTWARE\Microsoft\Edge with a hex string that is used to decrypt the strings in the Python backdoor.

T1176Software ExtensionsEvidence1

The technique utilizes a malicious Microsoft Edge browser extension that exploits the Chrome native messaging protocol... We have dubbed this web browser-based malware Edgecution.

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence2

the commands will configure the environment, fix the encrypted ZIP file headers, extract relevant files, and create a scheduled task that executes Microsoft Edge.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence2

Downloads an obfuscated AutoHotKey script... Downloads an encrypted ZIP file (with the PK magic bytes removed)... used to decrypt the strings in the Python backdoor.

T1036MasqueradingEvidence1

The unsuspecting victim is informed they they need a spam filter update and shown a fake Microsoft website... The Edgecution browser extension disguises itself as an Edge Monitoring Agent.

T1564.003Hidden WindowEvidence1

This will cause Microsoft Edge to load the extension in a hidden browser window without any user prompts or warnings.

Defense Impairment

1 technique

T1112Modify RegistryEvidence2

the set up scripts set a value named AppKey in the Windows registry under HKCU\SOFTWARE\Microsoft\Edge with a hex string that is used to decrypt the strings in the Python backdoor.

Credential Access

1 technique

T1056Input CaptureEvidence1

Updates RegistrationDisplays a form that requests the victim’s Microsoft365 / Outlook password.

Discovery

3 techniques

T1057Process DiscoveryEvidence2

110 6 Python Backdoor Retrieve a list of running processes.

T1082System Information DiscoveryEvidence2

1061Python BackdoorCollect and send system information.

T1083File and Directory DiscoveryEvidence2

the Python backdoor can directly access the victim’s filesystem... 108 4 Python Backdoor Write data to a specific filename / path.

Collection

1 technique

T1056Input CaptureEvidence1

Updates RegistrationDisplays a form that requests the victim’s Microsoft365 / Outlook password.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence2

The Edgecution browser extension communicates with the C2 server over websockets.

T1105Ingress Tool TransferEvidence1

1084Python BackdoorWrite data to a specific filename / path.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Jun 23, 2026

Payouts King Ransomware Initial Access Broker Deploys New Edgecution Malware - Malware News - Malware Analysis, News and Indicators

A malicious Microsoft Edge extension paired with a Python-based backdoor that abuses Chrome native messaging to escape the browser sandbox, communicate with C2 over WebSockets, collect system information, access the filesystem, execute shell/PowerShell/Python code, and launch processes for host compromise.

zscaler threat labzNews

Jun 23, 2026

Edgecution: Malicious Edge Extension Backdoor | ThreatLabz

A malware framework consisting of a malicious Microsoft Edge browser extension and a Python backdoor. It is deployed via social engineering, runs Edge in headless mode, communicates with C2 over WebSockets, and uses Chrome native messaging to escape the browser sandbox and execute commands, access the filesystem, run PowerShell/Python code, write files, and enumerate processes.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.