Malicious Edge Extension Abuses Native Messaging
A malicious Microsoft Edge extension dubbed 'Edgecution' has been used in a ransomware attack to escape the browser sandbox and deploy a Python-based backdoor. The extension leverages the Chrome Native Messaging protocol, which allows browser extensions to interact with native desktop applications.
Access to the local system is obtained by using the Native Messaging protocol to launch a native application as a separate process and communicate with it over standard input/output data streams. This protocol is typically used for legitimate purposes, such as a password manager communicating with the extension to fill in web forms.
Attack Vector
An Edgecution compromise begins with the attacker posing as IT support personnel on Microsoft Teams and directing employees to a fraudulent page under the pretense of installing a spam filter update. The page presents download buttons for update packs or software verification, but these buttons download malicious components, copy scripts to the clipboard, or launch forms requesting Microsoft 365 and Outlook passwords.
Researchers at cloud security company Zscaler believe that Edgecution is deployed by an initial access broker (IAB) connected to the Payouts Kings ransomware operation. The threat actor uses tactics previously associated with the IAB, including directing victims to a fake Microsoft “Outlook Updates Management Console” to download malicious components.
Malware Components
The malware components are fetched from the fake Microsoft update site in a ZIP archive with malformed headers to prevent security products from recognizing it as a valid archive. The ZIP file contains an embedded Python version 3.13.3 and two directories named extension and native, providing a hint about the technique used in the attack.
The first malware component is the malicious Microsoft Edge extension disguised as an Edge Monitoring Agent. It connects to the attacker’s command-and-control (C2) endpoint, receives instructions for execution, and sends the results back to the operator. The Edgecution malware runs in a headless Edge browser, making it invisible to the user, and uses Chrome's Native Messaging protocol to talk to a local application.
Python-Based Backdoor
The second malware component is a Python-based backdoor that serves as the host-level executor. This component receives commands that are relayed from the malicious extension and can potentially request the following jobs: execute shell commands, run PowerShell, run arbitrary Python code, write files on the host, enumerate running processes, and gather system information.
The role of the scripts is to provide a way for the extension to launch the Python backdoor. This is achieved by creating a batch file in the native directory that the extension can invoke. Additionally, they create the required Chrome native messaging manifest that describes how the browser can connect to the native app.
Recommendations
Zscaler's technical analysis notes that both malware components have some unused commands that could be activated in future versions. The researchers warn that the method used by Edgecution "illustrates the evolving sophistication" of threat actors tied to ransomware operations, and allows them to establish persistence on compromised hosts.
They recommend that organizations strengthen monitoring of browser extensions and enforce strict controls over native messaging host configurations to reduce the risk of compromise. ZScaler's report provides a list of indicators of compromise (IoCs) that include command and control servers used by Edgecution, hashes for the malicious extension, and the Python backdoor.
- Test every layer before attackers do
- Security teams log 54% of successful attacks and alert on just 14%.
- The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper to learn more about protecting your organization from malware attacks like Edgecution.
Source: BleepingComputer