MalwarePublished 24 Jun 2026

Malicious Edge extension abuses Native Messaging as bridge to malware

Source Bleeping Computer

python

Description

A malicious Microsoft Edge extension dubbed 'Edgecution' has been used in a ransomware attack to escape the browser sandbox and deploy a Python-based backdoor. [...]

Impact

This threat allows attackers to bypass the Microsoft Edge browser sandbox and execute arbitrary code on the host system via a Python backdoor. The attacker gains persistent remote access, can execute shell and PowerShell commands, run arbitrary Python code, write files, and gather system information. This capability facilitates ransomware deployment and other malicious activities, significantly compromising affected systems.

Defensive guidance

Organizations should strengthen monitoring of browser extensions, especially those using native messaging, and enforce strict controls over native messaging host configurations to reduce the risk of compromise. User awareness training to recognize social engineering attempts, such as fraudulent Microsoft Teams messages and fake update sites, is also recommended. Review and restrict installation of browser extensions to trusted sources only.

References

bleepingcomputer.com/news/security/malicious-edge-extension-abuses-native-messaging-as-bridge-to-malware/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 24 Jun 2026, 21:01 UTC

References

Community reviews

Related threats