Payouts King Ransomware Initial Access Broker Deploys New Edgecution Malware

As cited

Copy frozen at 2026-09-07 09:31 UTC (site build).

threat intel

Payouts King Ransomware Initial Access Broker Deploys New Edgecution Malware

Zscaler ThreatLabz identified Edgecution, a malicious Microsoft Edge browser extension deployed by an initial access broker linked to Payouts King ransomware. The extension abuses Chrome's native messaging protocol to bypass the browser sandbox, establishing communication with a Python-based backdoor that enables arbitrary code execution, filesystem manipulation, and process creation on compromised hosts. Initial compromise occurs through social engineering via Microsoft Teams impersonating IT staff, directing victims to fake Microsoft update websites that deliver obfuscated deployment scripts.

Why it matters: Organizations running Microsoft Edge are at risk from social engineering attacks that install persistent backdoors with privileged host access; security teams should monitor for suspicious Edge extension installations, native messaging host configurations, and educate users to verify IT requests through legitimate channels.

Source published

2026-06-23 14:57 UTC

First seen by Cybersecurity Tracker

2026-09-07 08:09 UTC