Edgecution malware exploits browser native messaging to bypass sandboxes (opens in new tab)

A new malware framework called Edgecution uses a malicious Microsoft Edge extension to establish a persistent foothold on Windows systems. Linked to an initial access broker for the Payouts King ransomware, the attack begins with social engineering messages on Microsoft Teams that impersonate IT support. Victims are directed to a fraudulent Outlook update page that delivers a payload containing a Python runtime and a malicious browser extension. <a href="