Payouts King-Linked Broker Uses Edgecution Malware to Gain Host Access
Summary
ThreatLabz reports that a Payouts King-linked initial access broker uses fake IT update prompts to install a hidden Edge extension and Python backdoor, enabling C2-driven system access and command execution.
Key points
- Victims are targeted through Microsoft Teams messages impersonating IT staff and a fake Outlook updates site, which can request Microsoft 365 credentials.
- AutoHotKey, batch, or PowerShell scripts deploy the malware, configure its files, and create a scheduled task to launch Edge in headless mode.
- The Edge extension uses Chrome native messaging to communicate with a Python backdoor beyond the browser sandbox.
- The backdoor can collect system information, access files, execute shell and PowerShell commands, run Python code, and list processes.
- The extension communicates with C2 servers over WebSockets; observed servers used cloudfront.net subdomains.
- ThreatLabz provides C2 addresses and SHA-256 hashes for the extension and Python backdoor.
Article Details
- Attack Vectors
- Social engineering through Microsoft Teams messages impersonating company IT staff, directing victims to a fake Microsoft updates website.
- The fake site offers an obfuscated AutoHotKey script, a Windows batch script, or a PowerShell script to deploy Edgecution; it also offers a disguised encrypted ZIP archive and a legitimate AutoHotKey executable.
- A fake updates registration form requests the victim’s Microsoft365 / Outlook password.
- A malicious Microsoft Edge extension uses Chrome native messaging to communicate with a Python backdoor and access host capabilities beyond the browser sandbox.
- Defensive Notes
- Monitor browser extension installations and strictly control native messaging host configurations.
- Train users to recognize and report suspicious prompts that imitate IT updates or management consoles.
- Use defense-in-depth measures, including monitoring for suspicious browser behavior and endpoint activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 3d1158884fb339b3328bd330fcc27598e1f1c94bcac39e75d1a272afa4deee1a | SHA-256 hash of the Edgecution Python backdoor. |
| SHA256 | a08d8e63b0cd3638fb40b8e6da546e26da69439597565827f9cec87915f78568 | SHA-256 hash of the Edgecution browser extension background.js. |
MITRE ATT&CK
T1053.005 · Scheduled TaskDeployment scripts create a scheduled task to launch Microsoft Edge with the malicious extension.T1055 · Process InjectionThe article describes browser sandbox escape through native messaging, not process injection.T1059.001 · PowerShellA backdoor command executes PowerShell commands or code.T1059.003 · Windows Command ShellThe deployment can use a Windows batch script to set up and deploy Edgecution.T1059.004 · Unix ShellThe backdoor can execute shell commands on the compromised host.T1059.006 · PythonThe Python backdoor executes Python code and is launched by a batch file.T1059.010 · AutoHotKey & AutoITAn obfuscated AutoHotKey script can be used to set up and deploy Edgecution.T1566.003 · Spearphishing via ServiceAttackers send Microsoft Teams messages impersonating company IT staff to socially engineer victims.
Threat Actors
Malware
Vendors
Products
Microsoft Edgetactics paired with an innovative malware delivery mechanism. The technique utilizes a malicious Microsoft Edge browser extension that exploits the Chrome native messaging protocol to interact with host-nativeMicrosoft TeamsThese attacks typically start via social engineering through Microsoft Teams messages that impersonate a company’s IT staff. The unsuspecting victim is informed they they need a spam filter update and shown a fakeMicrosoft365Displays a form that requests the victim’s Microsoft365 / Outlook password.OutlookFigure 1: Fake Microsoft website disguised as an “Outlook Updates Management Console”.