Edgecution Uses Native Messaging to Deploy a Python Backdoor
Summary
Zscaler describes Edgecution, a malicious Edge extension delivered through fake Microsoft support and update pages. It uses Chrome Native Messaging to relay commands to a Python backdoor; researchers link the activity to an initial access broker associated with Payouts’
Key points
- Attackers posed as IT support on Microsoft Teams and directed victims to a fake Outlook Updates Management Console.
- Deceptive download buttons delivered scripts and malware components, including a ZIP archive with malformed headers.
- Edgecution runs in a headless Edge browser and uses Chrome Native Messaging to communicate with a local application.
- A Python-based backdoor relays host-level tasks, including running commands, writing files, and enumerating processes.
- Scripts create a scheduled task to launch Edge and configure the native messaging manifest used to connect the extension to the backdoor.
- Zscaler links the activity to an initial access broker associated with the Payouts Kings ransomware operation; the article does not report independent confirmation of that attribution.
- Zscaler recommends monitoring browser extensions and strictly controlling native messaging host configurations.
Article Details
- Attack Vectors
- Attackers posed as IT support on Microsoft Teams and directed employees to a fraudulent Outlook Updates Management Console page.
- Deceptive download buttons on the fake Microsoft page delivered malicious components, copied scripts to the clipboard, or presented forms requesting Microsoft 365 and Outlook passwords.
- AutoHotKey, Windows batch, and PowerShell scripts configured the environment, extracted files from a ZIP archive with malformed headers, and created a scheduled task to launch Microsoft Edge.
- The Edgecution extension, disguised as an Edge Monitoring Agent, used Chrome Native Messaging to communicate with a local application and relay commands to a Python-based backdoor.
- The backdoor could execute shell commands, run PowerShell or Python code, write files, enumerate processes, and gather system information.
- Defensive Notes
- Strengthen monitoring of browser extensions.
- Enforce strict controls over native messaging host configurations.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe ZIP archive used malformed headers to prevent security products from recognizing it as a valid archive.T1041 · Exfiltration Over C2 ChannelThe Edgecution extension sent command results back to the operator through its C2 connection.T1053.005 · Scheduled TaskThe scripts created a scheduled task that launched Microsoft Edge.T1057 · Process DiscoveryThe backdoor could enumerate running processes.T1059.001 · PowerShellThe deployment scripts could run PowerShell, and the backdoor could execute PowerShell commands.T1059.003 · Windows Command ShellThe backdoor could execute shell commands, and a Windows batch script was used in deployment.T1059.006 · PythonThe Python-based backdoor could execute arbitrary Python code.T1082 · System Information DiscoveryThe backdoor could gather system information.T1105 · Ingress Tool TransferMalicious components were downloaded from the fake Microsoft update site in a ZIP archive.T1176 · Software ExtensionsThe malicious Edgecution browser extension was disguised as an Edge Monitoring Agent.T1566.003 · Spearphishing via ServiceAttackers used Microsoft Teams to pose as IT support and direct employees to a fraudulent update page.
Threat Actors
Malware
Products
Google ChromeThe campaign relied on fake Microsoft support pages, Chrome Native Messaging, and a disguised Edge Monitoring Agent to run commands and maintain persistence.Microsoft 365 Apps for EnterpriseHowever, the buttons downloaded malicious components, copied scripts to the clipboard, or launched forms requesting Microsoft 365 and Outlook passwords.Microsoft EdgeA malicious Microsoft Edge extension called Edgecution was used in a ransomware-related attack to escape the browser sandbox and deploy a Python-based backdoor.Microsoft TeamsAttackers posed as IT support on Microsoft Teams to lure victims to fake update pages.Outlookusing tactics previously associated with the IAB, the threat actor directed victims to a fake Microsoft “Outlook Updates Management Console” presenting download buttons for update packs or software verification.