Edgecution is a sophisticated malware deployed by an initial access broker linked to Payouts King ransomware. It consists of a malicious Microsoft Edge browser extension and a Python-based backdoor. The infection vector involves social engineering through Microsoft Teams, where attackers impersonate IT personnel and lure victims to fake Microsoft sites offering Outlook updates. The browser extension communicates with C2 servers via websockets and exploits the Chrome native messaging protocol to break out of browser sandboxing, enabling direct interaction with the host system. This capability allows attackers to manipulate files, execute processes, and run arbitrary code stealthily within a headless browser environment. Deployment mechanisms include AutoHotKey, Windows batch, and PowerShell scripts. The Python backdoor facilitates various commands such as system reconnaissance, filesystem operations, and arbitrary code execution.

Successful deployment of Edgecution malware grants attackers persistent and stealthy access to the victim's host system with capabilities to manipulate the filesystem, execute arbitrary code, and gather system information. This can facilitate further malicious activities including ransomware deployment. The malware's use of browser extension sandbox escape techniques and headless operation increases its stealth and persistence on compromised systems.

No official patch or remediation is provided for this malware. Mitigation should focus on user awareness to prevent social engineering attacks, especially those impersonating IT staff via Microsoft Teams. Organizations should monitor for suspicious browser extensions and unusual script executions (AutoHotKey, batch, PowerShell). Blocking or scrutinizing connections to known malicious command-and-control servers and employing endpoint detection capable of identifying malicious browser extension behavior and Python backdoors is recommended. Since this is malware rather than a software vulnerability, no direct patch exists. Review vendor advisories and threat intelligence sources for updates.