Edgecution: abusing the Chrome/Edge Native Messaging API as a browser-sandbox-to-host bridge
Background. Browser-extension-to-host pivoting is not a new idea — the Native Messaging API (the stdio IPC channel that lets a browser extension talk to a registered local executable) has been a documented abuse surface for years, and EDR coverage of browser child-processes remains uneven. What Zscaler ThreatLabz documents in Edgecution is this class turned into a working, in-the-wild initial-access toolset operated by the Payouts Kings group (Zscaler ThreatLabz, 2026-06-23 · BleepingComputer, 2026-06-24).
Initial access. The chain begins with a Microsoft Teams social-engineering lure: attackers impersonate IT support and direct the victim to a fraudulent Outlook "update" portal (T1204.002 User Execution: Malicious File, preceded by T1656 impersonation). The download is a ZIP bundling an embedded Python 3.13.3 runtime, a malicious Edge extension presented as an "Edge Monitoring Agent", and the native-messaging host components that register the extension-to-executable channel.
Sandbox-to-host bridge. The extension runs inside a headless (hidden-window) Edge instance invisible to the user (T1564.003 Hide Artifacts: Hidden Window), beacons to C2 hosted on cloudfront.net subdomains over HTTPS (T1071.001 Application Layer Protocol: Web Protocols), and relays received commands across the Native Messaging stdio channel (T1559 Inter-Process Communication) to a Python backdoor running on the host. The design point is evasion: controls that watch the browser process tree but not the native-messaging-host child process never see the host commands cross the boundary.
On-host capability. The Python backdoor (T1059.006 Command and Scripting Interpreter: Python) implements shell and PowerShell command execution, arbitrary code execution, file writes, process enumeration and system reconnaissance — a full IAB foothold from which ransomware affiliates can be sold access. Zscaler reports the observed C2 used cloudfront.net subdomains hosted on AWS, which blend with legitimate CDN traffic.
Hunt and detection concepts. (1) Process-tree rule: msedge.exe spawning a native-messaging host executable followed by a Python interpreter invocation is the kill-chain signature — the host process is registered under HKCU\Software\Microsoft\Edge\NativeMessagingHosts\. (2) Registry monitoring: additions under that key by anything other than a legitimate installer (Sysmon EID 13). (3) Process telemetry: a headless/hidden Edge instance launched outside normal user interaction (Sysmon EID 1, command-line flags indicating an automation/headless profile). (4) Network: CloudFront-subdomain beaconing originating from msedge.exe or a Python child in an environment that does not normally use those endpoints.
Hardening. Enterprise browsers should restrict extension installation to approved publisher IDs via Group Policy (ExtensionInstallAllowlist, and BlockExternalExtensions), and allow-list Native Messaging hosts explicitly. Blocking user-profile (HKCU) Native Messaging host registration via AppLocker/WDAC removes this persistence and bridging path. Because the entry point is a Teams IT-helpdesk lure, the same control that blunts ClickFix/FileFix — preventing users from running attacker-supplied scripts and constraining who can deliver Teams messages from outside the tenant — applies here too.
Edgecution has two components: a Microsoft Edge browser extension that beacons to a command-and-control (C2) server and relays host-based commands to a Python-based backdoor
the attackers gain direct host access, enabling them to manipulate the local filesystem, launch processes, and execute arbitrary code on the compromised host
ATT&CK mapping
10 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Execution TA0002
T1059Command and Scripting Interpreter
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.
T1059.006Command and Scripting Interpreter: Python
Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the <code>python.exe</code> interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.
T1204User Execution
An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing.
T1204.002User Execution: Malicious File
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.
T1559Inter-Process Communication
Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.
Stealth TA0005
T1564Hide Artifacts
Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.
T1564.003Hide Artifacts: Hidden Window
Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks.
T1684.001Social Engineering: Impersonation
Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims.
Command and Control TA0011
T1071Application Layer Protocol
Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
T1071.001Application Layer Protocol: Web Protocols
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.