Payouts King Initial Access Broker Deploys Edgecution Malware Through Malicious Edge Extension

A concerted campaign by an initial access broker with ties to the Payouts King ransomware ecosystem that leverages a novel browser-based delivery technique to establish persistent host-level control.

The actor deploys a malicious Microsoft Edge extension dubbed “Edgecution” which abuses the Chrome native messaging protocol to reach a Python backdoor running on the endpoint, effectively escaping the browser sandbox and enabling full filesystem and process control.

The intrusion chain begins with targeted social engineering, typically via Microsoft Teams messages impersonating corporate IT personnel and directing victims to a convincingly forged “Outlook Updates Management Console.”

That lure offers multiple deployment vectors: an obfuscated AutoHotkey script, a legitimate AutoHotkey executable, encrypted archive downloads, and clipboard-pasted batch or PowerShell setup scripts.

Any of these options configure the environment, repair a deliberately corrupted ZIP archive, extract payloads and schedule a hidden, headless Edge instance that loads the malicious extension from a locally created user-data directory.

Setup scripts create a Chrome native messaging manifest pointing to a native_host.bat wrapper which launches the Python backdoor unbuffered.

Zscaler said in a report shared with GBhackers, Edgecution comprises two primary components: a browser extension that beacons to a command-and-control (C2) server over WebSockets and a Python 3.13.3 distribution acting as the native backdoor.

The extension communicates with that native host via chrome.runtime.sendNativeMessage using a campaign-specific name such as com.[rand_chars].api, enabling the extension to relay privileged commands that the browser itself cannot execute.

Payouts King Initial Access Broker

Communication and command orchestration are modular. The extension implements a C2 protocol with heartbeat and control messages; message type 10 carries commands.

Some commands execute within the extension (keyword and tab monitoring, stats), but privileged actions are forwarded to the Python backdoor where they map to actions such as system information collection, arbitrary Python execution, writing files, launching processes, listing processes, and running PowerShell.

The backdoor exchanges JSON messages over stdio with a four-byte length prefix; it spawns a fresh Python process per command and exits after sending results.

To avoid easy discovery, the extension is loaded in a headless Edge instance and configured to store the C2 address in browser local storage; setup scripts even write an AppKey in the registry that the backdoor uses to decrypt its strings.

ThreatLabz observed that all C2 infrastructure leveraged cloudfront.net subdomains hosted on AWS, consistent with opportunistic use of legitimate cloud services for C2.

The delivery chain also includes evasive measures: encrypted ZIP files with altered headers to evade network signatures, decoy keyword-monitoring functionality, and multiple redundant installation routes (AutoHotkey, batch, PowerShell) to increase success rates.

This technique illustrates a pragmatic evolution in initial access tactics: using native messaging to pivot from a sandboxed browser context to a native runtime permits attackers to combine stealthy, user-facing social engineering with powerful host-level capabilities.

Defenders should prioritize monitoring for unusual headless browser launches, auditing Chrome/Edge native messaging host registrations, restricting extension sideloading and scheduled tasks that launch browsers with custom user-data directories, and training users to treat unsolicited update prompts with suspicion.

Indicators Of Compromise (IOCs)

Indicator	Description
wss://d3nh8sl98s2554.cloudfront[.]net/ws	Edgecution C2 server
wss://d2g6dl71gua1qa.cloudfront[.]net/ws	Edgecution C2 server
wss://d1jp293q9tvi92.cloudfront[.]net/ws	Edgecution C2 server
wss://d23l50n6ubud7p.cloudfront[.]net/ws	Edgecution C2 server
a08d8e63b0cd3638fb40b8e6da546e26da69439597565827f9cec87915f78568	SHA256 Edgecution browser extension (background.js)
3d1158884fb339b3328bd330fcc27598e1f1c94bcac39e75d1a272afa4deee1a	SHA256 Edgecution Python backdoor

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.