Loading story…
Zscaler ThreatLabz reported that an initial access broker linked to Payouts King ransomware is deploying Edgecution, a malware framework that combines a malicious Microsoft Edge extension with a Python backdoor. The intrusion typically starts with Microsoft Teams social-engineering messages impersonating IT staff and directing targets to a fake Microsoft Outlook or Microsoft update page, which delivers deployment scripts, a legitimate AutoHotKey executable, and an encrypted ZIP archive. The scripts then create a hidden Edge profile, install the extension and Python components, configure a Chrome native messaging host, store a decryption key in the Windows registry, and schedule Edge to run headlessly with the malicious extension loaded.
Edgecution abuses Chrome native messaging to bypass normal browser sandbox restrictions and relay privileged commands from the extension to the Python backdoor. Researchers said the extension communicates with command-and-control infrastructure over WebSockets, with observed cloudfront.net subdomains hosted on AWS, while the browser-monitoring features appear to be a decoy because Edge runs in headless mode. The backdoor provides operators with system reconnaissance, process enumeration, file-writing capability, shell and PowerShell execution, Python code execution, and broader arbitrary command execution, giving ransomware-affiliated actors a stealthy foothold that may evade some traditional endpoint and sandbox defenses.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
eSentire reported that in July 2026 UNC6692 targeted a software-industry customer using email bombing, Microsoft Teams IT impersonation, Quick Assist, and an Amazon S3-hosted phishing site to deploy Edgecution. The report added incident-specific details on credential theft, AutoHotkey staging, persistence, EDR-aware behavior, and noted that eSentire isolated the affected host.
Zscaler ThreatLabz published research describing Edgecution, a malware framework consisting of a malicious Microsoft Edge extension and a Python backdoor that abuses Chrome native messaging to escape browser sandbox restrictions. The report linked the activity to an initial access broker associated with Payouts King ransomware and detailed delivery via Microsoft Teams social engineering and a fake Microsoft update site.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
9 references tracked. Mallory keeps watching after this page renders.
esentire.com
Open sourcecysecurity.news
Open sourcescworld.com
Open sourcecommunity.gurucul.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcemalware.news
Open sourcezscaler.com
Open sourcedeveloper.chrome.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs documented **REF9334**, a Brazil-focused banking-malware operation active since at least May 2025 that delivers the KREMLIN toolkit through Portuguese-language document lures impersonating financial institutions. Multi-stage JavaScript, Node.js, and C++ components use anti-analysis checks, RunPE execution, and SentinelOne DLL sideloading; the campaign has also deployed PULSAR and REMCOS remote-access trojans. KREMLIN silently installs a malicious Chromium extension named **“AVSync System Inc.”** by modifying Chrome and Edge Secure Preferences and regenerating browser integrity values. The extension can collect saved credentials, cookies, session tokens, browser storage, page content, screenshots, and keystrokes. Its operators use Ethereum smart contracts as resilient dead-drop resolvers for mutable payload and C2 configuration, alongside Archive.org-hosted JPEG carriers. After researchers registered an unclaimed network-canary domain, 1,515 infected hosts checked in—98.75% of them geolocated in Brazil—before implants identified the environment as a sandbox and halted later-stage activity.
Sep 18, 2026
Cisco Talos reported that the Chaos ransomware group is using a new Rust-based remote access trojan, **msaRAT**, to conceal command-and-control traffic inside legitimate browser activity. Instead of making direct outbound connections, the malware launches a headless **Google Chrome** or **Microsoft Edge** instance with the **Chrome DevTools Protocol** enabled, injects JavaScript, and uses the browser to establish a **WebRTC DataChannel** for encrypted communications. Talos said the malware combines WebRTC **DTLS** with its own **ChaCha-Poly1305** encryption using an **ECDH**-derived shared key, giving operators covert tunneling, browser-assisted remote code execution, and asynchronous multi-threaded control. The reported intrusion chain begins with email or voice phishing, followed by the use of remote management software for persistence and delivery of an MSI installer disguised as a Windows update. That installer, identified as **`update_ms.msi`**, is downloaded over plain HTTP on port 443, extracts **`lib.dll`**, and loads it directly into memory before starting the browser in remote debugging mode. For signaling, the browser communicates with a **Cloudflare Workers** endpoint, while **Twilio TURN** infrastructure relays WebRTC traffic, a design that obscures attacker-controlled systems and makes network-based detection and attribution more difficult.
Jul 27, 2026
Security researchers reported multiple **malicious browser-extension** campaigns abusing official extension stores and search-driven lures to compromise enterprise users. Huntress documented a Chrome Web Store extension, **“NexShield – Advanced Web Guardian”** (a near-clone of *uBlock Origin Lite*), distributed via search/advertising redirection and designed to intentionally “freeze” the browser and present a fake **CrashFix** security prompt that instructs users to paste and run commands via `Win + R`; this social-engineering step results in installation of a previously undocumented Windows RAT dubbed **ModeloRAT** on domain-joined endpoints. Reporting also tied the delivery to a traffic distribution system (**KongTuke**, also tracked as **404 TDS/TAG-124** and other aliases) used to profile victims and route them to payload delivery infrastructure that has been leveraged by other criminal operations, including ransomware affiliates. Separately, Socket.dev analysis described **five coordinated Chrome extensions** targeting enterprise SaaS platforms (**Workday, NetSuite, SuccessFactors**) to enable account takeover via **session hijacking**, including continuous token theft and **bidirectional cookie injection** that can bypass MFA by replaying stolen session cookies. In parallel, Malwarebytes reported “sleeper” extension campaigns attributed to **DarkSpectre** (including **GhostPoster** and **ShadyPanda**) that turned previously benign extensions malicious after updates and used **steganography** (JavaScript hidden in extension images) to evade detection across **Edge, Chrome, and Firefox**, with large download counts and long dwell time. A separate Nextron Systems report described a related distribution pattern—malicious “free converter” apps promoted via **malicious Google ads** and made to look legitimate with **code-signing certificates**—highlighting the broader trend of search/advertising-driven initial access leading to persistent RAT deployment, though it is not the same extension-specific incident as the NexShield/CrashFix chain.
Jun 29, 2026