Edgecution Malware Uses Microsoft Teams Phishing and Edge Extensions to Deploy Ransomware Backdoor

Threat actors linked to the Payouts King ransomware operation have been observed deploying a novel malware campaign that uses Microsoft Teams impersonation to deliver a malicious Microsoft Edge browser extension, ultimately establishing a persistent backdoor that escapes the browser sandbox and executes commands with full host-level access. The campaign, tracked by Zscaler ThreatLabz, is named Edgecution after the malicious extension at its core. It represents a technical evolution in initial access techniques that is directly relevant to GCC enterprise environments where Microsoft Teams is the dominant enterprise communication platform across government, financial services, and corporate environments.

How the Attack Works

The attack chain begins with social engineering via Microsoft Teams. Threat actors impersonate corporate IT staff and send messages to employees claiming that an urgent spam filter update is required. Victims are directed to a fraudulent website designed to resemble an Outlook Updates Management Console. The fake portal presents multiple download options, including an AutoHotKey script, a Windows batch script, and a PowerShell command, giving the threat actor three separate deployment paths against targets with different security tooling.

When a victim interacts with the fake update portal, the site delivers an encrypted ZIP archive with intentionally malformed file headers, a design choice made specifically to evade network-level security signatures during transit. Once the victim executes the provided script, the malware repairs the ZIP headers, extracts an embedded Python 3.13.3 distribution, the malicious Edge extension, and an obfuscated Python backdoor into a local application data directory. The setup scripts then modify the Windows registry and create a scheduled task that launches Microsoft Edge in headless, hidden mode, loading the malicious extension silently without triggering any user prompts.

The Sandbox Escape Mechanism

The core technical innovation of Edgecution is its two-component architecture, specifically designed to break out of the browser security sandbox. The first component is the malicious Edge extension, which masquerades as an Edge Monitoring Agent. It establishes a WebSocket connection to command-and-control servers hosted on Amazon Web Services via CloudFront subdomains. Browser extensions are normally confined by security sandboxes that prevent direct system access. Edgecution overcomes this by exploiting the Chrome Native Messaging protocol, a legitimate mechanism that allows browser extensions to interact with native desktop applications, such as a password manager communicating with its browser extension.

The setup scripts drop a batch file and a native messaging manifest that explicitly authorise the malicious extension to invoke local system applications. The browser extension then uses this authorised bridge to forward privileged commands from the command-and-control server directly to the second component: a Python-based backdoor operating at the host level. Once activated, the backdoor can execute shell commands, run PowerShell, run arbitrary Python code, write files to specific paths, enumerate running processes, gather system information, and download and execute additional payloads. The result is a full remote access capability that originates from a trusted browser process, making it significantly harder to detect through conventional endpoint monitoring.

Why This Matters for GCC Enterprises

Microsoft Teams is deployed across virtually every GCC government entity, financial institution, and large enterprise. The MuddyWater false flag campaign that breached an Oman Ministry and a UAE port earlier this year also used Microsoft Teams as the initial access vector, demonstrating that GCC threat actors are actively exploiting the trust users place in the platform. Edgecution does not require vulnerabilities in Teams itself. It exploits the social trust employees place in messages that appear to come from IT departments, a tactic that bypasses technical controls and targets human behaviour instead.

The use of a browser extension as the attack vehicle is also significant. Browser extensions are frequently excluded from enterprise endpoint detection programmes that focus on executables and scripts. An extension running in a headless browser process, communicating with CloudFront infrastructure over encrypted WebSocket connections, presents a detection challenge that many GCC enterprise security operations centres are not currently configured to address. Organisations running Microsoft 365 and Azure environments should note that Edgecution specifically targets Microsoft ecosystem trust relationships, abusing the Teams channel, the Edge browser, and Microsoft-adjacent branding to move through enterprise environments.

Defensive Actions for GCC Security Teams

Strengthen monitoring of browser extension installations across all managed endpoints. Browser extension management policies should be enforced via Group Policy or Microsoft Intune, restricting installation to approved extensions only. Extensions installed outside of approved channels should generate automatic alerts.

Enforce strict controls over Chrome Native Messaging host configurations. The native messaging manifest that Edgecution deploys at setup is the key mechanism enabling sandbox escape. Native messaging host configurations should be audited and unknown entries investigated immediately.

Train employees specifically on IT impersonation via Microsoft Teams. The Edgecution attack does not require any vulnerability to succeed. It requires one employee to trust a message that appears to come from IT and click a download link. User awareness training that specifically addresses Teams-based impersonation is the most effective control against this attack vector. The UAE NESA Information Assurance Standards include mandatory security awareness training requirements. Edgecution-style campaigns are precisely the attack class those requirements were designed to address.

Confirm that endpoint detection and response tooling covers browser extension activity, headless browser process spawning, and native messaging manifest creation. The three confirmed command-and-control domains associated with this campaign are wss://d3nh8sl98s2554.cloudfront.net/ws, wss://d2g6dl71gua1qa.cloudfront.net/ws, and wss://d1jp293q9tvi92.cloudfront.net/ws. These should be blocked across all network egress controls immediately.