Edgecution: Payouts King Initial Access Broker Deploys Malicious Microsoft Edge Extension with Embedded Python Backdoor
Edgecution: Payouts King Initial Access Broker Deploys (TL-2026-0917), also tracked as Edgecution, is a high-severity malware campaign, first published 2026-06-23. It is attributed to Payouts King initial access broker with high confidence, affects Microsoft Microsoft Edge, maps to 28 MITRE ATT&CK techniques (T1027, T1036.005, T1041), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-0917
- Threat ID
- TL-2026-0917
- Also known as
- Edgecution
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-23
- Last reviewed
- 2026-06-23
- Attribution
- Payouts King initial access broker
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- enterprise, managed-service-providers, technology
- Target regions
- North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Edgecution: Payouts King Initial Access Broker Deploys
Malware and tooling: Edgecution, Win64.Ransom.PayoutsKing, Edge Monitoring Agent
An initial access broker tied to the Payouts King ransomware operation is deploying Edgecution, a malicious Microsoft Edge extension that abuses Chrome native messaging to escape the browser sandbox and execute commands via an embedded Python 3.13.3 backdoor. Initial access is achieved through Microsoft Teams social engineering impersonating IT staff who direct victims to fake Microsoft 'Outlook Updates' portals. C2 runs over WebSocket on AWS CloudFront subdomains.
How Edgecution: Payouts King Initial Access Broker Deploys works
Zscaler ThreatLabz documented Edgecution, a novel intrusion toolkit operated by an initial access broker affiliated with the Payouts King ransomware group (former BlackBasta affiliates active since April 2025). The campaign begins with social engineering: attackers impersonate internal IT staff over Microsoft Teams and direct victims to a fake 'Outlook Updates Management Console' portal offering bogus Outlook updates. The portal presents multiple buttons that deliver an obfuscated AutoHotKey script, a legitimate AutoHotKey executable used to run it, and an encrypted ZIP archive whose PK magic bytes are stripped to evade detection. A credential-harvesting 'Updates Registration' form captures passwords, and 'verification' buttons paste Windows batch and PowerShell reconnaissance scripts to the clipboard for the victim to run.
The encrypted ZIP unpacks an embedded Python 3.13.3 runtime, an extension directory, and a native-messaging directory into %LOCALAPPDATA%\Microsoft\Edge\User Data est1. A registry value, AppKey under HKCU\SOFTWARE\Microsoft\Edge, stores a hex string used to decrypt obfuscated strings inside the Python backdoor. Microsoft Edge is launched headless (--headless=new) with a dedicated user-data directory and the malicious unpacked extension side-loaded via --load-extension, masquerading as an 'Edge Monitoring Agent.'
The core of the attack is abuse of Chrome/Chromium native messaging (T1559.001). The extension registers a native messaging host (manifest name com.[rand_chars].api) pointing at native ative_host.bat, which bridges the sandboxed extension to host-level command execution through the embedded Python interpreter. Communication uses the standard 4-byte length-prefixed JSON stdio protocol. The extension speaks to its operator over a WebSocket C2 channel hosted on AWS CloudFront subdomains, using a typed message protocol (hello, VAPID key exchange, 20-second ping/pong heartbeat, command delivery, results, keyword-hit notifications, and push subscription). Commands span browser-level operations (URL keyword monitoring, tab enumeration, active-tab reporting) and host-level operations routed through the Python backdoor (system info collection, shell execution, file write, arbitrary Python execution, process enumeration, PowerShell execution, and C2 URL update). The backdoor spawns a fresh Python process per command and exits after responding, and can delete its on-disk C2 configuration file after syncing the server URL into chrome.storage.local for stealth.
This access tooling is a precursor to Payouts King ransomware deployment. Payouts King performs double extortion with 4,096-bit RSA and 256-bit AES-CTR file encryption, employs direct syscalls and FNV1/custom-CRC string obfuscation to evade EDR, and checks against 131 hardcoded security-product checksums for process termination.
MITRE ATT&CK techniques used in TL-2026-0917
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1564.003 Hidden Window
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053.005 Scheduled Task; T1176 Software Extensions
Credential Access
Discovery
T1057 Process Discovery; T1082 System Information Discovery
Execution
T1059 Command and Scripting Interpreter; T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.006 Python; T1204.002 Malicious File; T1559.001 Component Object Model
Command and Control
T1071.001 Web Protocols; T1102.002 Bidirectional Communication; T1105 Ingress Tool Transfer
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools
Collection
T1185 Browser Session Hijacking
Initial Access
T1199 Trusted Relationship; T1566.002 Spearphishing Link; T1566.003 Spearphishing via Service
Impact
T1486 Data Encrypted for Impact
Resource Development
Affected products and versions in Edgecution: Payouts King Initial Access Broker Deploys
- Microsoft — Microsoft Edge
Vulnerable versions: Chromium-based Edge with extension side-loading / native messaging enabled - Microsoft — Microsoft Teams
Vulnerable versions: Tenants allowing external/unknown-user chat - Microsoft — Windows
Vulnerable versions: Windows endpoints with user-writable LOCALAPPDATA/APPDATA
Remediation for Edgecution: Payouts King Initial Access Broker Deploys
Immediate actions
- Block the four CloudFront WebSocket C2 endpoints (d3nh8sl98s2554, d2g6dl71gua1qa, d1jp293q9tvi92, d23l50n6ubud7p .cloudfront.net) at the egress proxy/firewall
- Hunt for Edge launched with --load-extension and --headless=new outside of managed automation
- Search for the directory %LOCALAPPDATA%\Microsoft\Edge\User Data\test1 and native\native_host.bat
- Block the two Edgecution SHA256 hashes and the two Payouts King ransomware hashes on EDR/AV
Workarounds
- Disable Edge developer-mode/unpacked extension loading via DeveloperToolsDisabled and BlockExternalExtensions policies
- Restrict clipboard-paste-to-terminal user workflows and educate staff on the fake 'Outlook Updates' lure
Longer-term hardening
- Enforce Edge ExtensionInstallBlocklist=* with an allowlist (ExtensionInstallAllowlist) via group policy to prevent unpacked side-loading
- Restrict registration of native messaging hosts via NativeMessagingBlocklist policy
- Deploy EDR with behavioral detection for native messaging host process chains (msedge.exe -> cmd.exe/native_host.bat -> python.exe)
- Harden Microsoft Teams to block external-tenant chat and inbound messages from unknown users
Weaknesses (CWE) in Edgecution: Payouts King Initial Access Broker Deploys
CWE-829, CWE-668, CWE-94
Timeline of Edgecution: Payouts King Initial Access Broker Deploys
- BlackBasta ransomware group disbands following the public leak of its internal chat logs; affiliates and initial access brokers disperse, retaining their social-engineering tradecraft (spam bombing, Microsoft Teams lures, Quick Assist abuse).
- Payouts King ransomware emerges, attributed by Zscaler ThreatLabz with high confidence to former BlackBasta affiliates; uses 4096-bit RSA + 256-bit AES-CTR encryption, double extortion, direct syscalls, and 131 hardcoded security-product checksums for process termination.
- ThreatLabz observes ransomware activity consistent with prior BlackBasta initial access brokers, who continue to use spam bombing, Microsoft Teams impersonation, and Quick Assist for initial access.
- Zscaler ThreatLabz publishes 'Payouts King Takes Aim at the Ransomware Throne,' documenting the ransomware's EDR-evasion via obfuscation and direct syscalls and its double-extortion model.
- Threadlinqs Intelligence ingests TL-2026-0917 and begins detection engineering for Edge unpacked-extension side-loading and native messaging host abuse.
- Four CloudFront WebSocket C2 endpoints and two SHA256 hashes (extension background.js and Python backdoor) published as IOCs.
- ThreatLabz documents the typed WebSocket C2 protocol (hello, VAPID key, 20s ping/pong, command, results, keyword-hit, push) and 8 host-level backdoor commands (sysinfo, shell, file write, Python exec, process enum, PowerShell, C2 update, config delete) over a 4-byte length-prefixed JSON stdio bridge.
- ThreatLabz details the kill chain: AutoHotKey/batch/PowerShell delivery options, a PK-magic-stripped encrypted ZIP, an AppKey registry decryption value, a Windows scheduled task launching headless Edge (--headless=new --load-extension), and a native-messaging host bridging the sandboxed extension to host command execution.
- Zscaler ThreatLabz publishes analysis of Edgecution: a malicious Edge extension abusing Chrome native messaging with an embedded Python 3.13.3 backdoor, deployed by a Payouts King initial access broker via a fake 'Outlook Updates Management Console' Teams lure.
Sources cited for Edgecution: Payouts King Initial Access Broker Deploys
- Payouts King Ransomware Initial Access Broker Deploys New Edgecution
- Payouts King Takes Aim at the Ransomware Throne
- Payouts King Takes Aim at the Ransomware Throne (Security Boulevard)
- Payouts King Ransomware Bypasses EDR via Obfuscation and Direct Syscalls
- Zscaler ThreatLabz Threat Library
- MITRE ATT&CK T1559.001 Inter-Process Communication: Component Object Model / Native Messaging
Threats related to Edgecution: Payouts King Initial Access Broker Deploys
- Payouts King Ransomware — BlackBasta-Affiliate RaaS Evades EDR via Direct System Calls, ntdll Export-Table Walking, and SetFileInformationByHandle Rename Evasion (Zscaler ThreatLabz)
- GOLD ENCOUNTER / Payouts King Ransomware Campaign Targeting Business Managers: 351 Victims Across 334 Organizations
- PhantomEnigma Campaign: 20+ Hijacked Brazilian Government Websites Distribute Banking Backdoor via Patched Electron Apps
- InstallFix Campaign — Fake Claude AI Installer via Google Ads Drops mshta/ZIP-HTA Polyglot, AMSI-Bypass PowerShell & RedLine Stealer
- Operation HumanitarianBait — PyArmor-Packed Python Surveillance Implant Targeting Russian-Speakers via LNK/RAR Lures
Detection coverage for TL-2026-0917
As of 2026-06-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0917 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.