# Edgecution: Payouts King Initial Access Broker Deploys Malicious Microsoft Edge Extension with Embedded Python Backdoor

> An initial access broker tied to the Payouts King ransomware operation is deploying Edgecution, a malicious Microsoft Edge extension that abuses Chrome native messaging to escape the browser sandbox and execute commands via an embedded Python 3.13.3 backdoor. Initial access is achieved through Microsoft Teams social engineering impersonating IT staff who direct victims to fake Microsoft 'Outlook Updates' portals. C2 runs over WebSocket on AWS CloudFront subdomains.

- **Published:** 2026-06-23T00:00:00Z
- **Last reviewed:** 2026-06-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0917
- **ID:** TL-2026-0917
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Payouts King initial access broker
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Zscaler ThreatLabz documented Edgecution, a novel intrusion toolkit operated by an initial access broker affiliated with the Payouts King ransomware group (former BlackBasta affiliates active since April 2025). The campaign begins with social engineering: attackers impersonate internal IT staff over Microsoft Teams and direct victims to a fake 'Outlook Updates Management Console' portal offering bogus Outlook updates. The portal presents multiple buttons that deliver an obfuscated AutoHotKey script, a legitimate AutoHotKey executable used to run it, and an encrypted ZIP archive whose PK magic bytes are stripped to evade detection. A credential-harvesting 'Updates Registration' form captures passwords, and 'verification' buttons paste Windows batch and PowerShell reconnaissance scripts to the clipboard for the victim to run.

The encrypted ZIP unpacks an embedded Python 3.13.3 runtime, an extension directory, and a native-messaging directory into %LOCALAPPDATA%\Microsoft\Edge\User Data\test1. A registry value, AppKey under HKCU\SOFTWARE\Microsoft\Edge, stores a hex string used to decrypt obfuscated strings inside the Python backdoor. Microsoft Edge is launched headless (--headless=new) with a dedicated user-data directory and the malicious unpacked extension side-loaded via --load-extension, masquerading as an 'Edge Monitoring Agent.'

The core of the attack is abuse of Chrome/Chromium native messaging (T1559.001). The extension registers a native messaging host (manifest name com.[rand_chars].api) pointing at native\native_host.bat, which bridges the sandboxed extension to host-level command execution through the embedded Python interpreter. Communication uses the standard 4-byte length-prefixed JSON stdio protocol. The extension speaks to its operator over a WebSocket C2 channel hosted on AWS CloudFront subdomains, using a typed message protocol (hello, VAPID key exchange, 20-second ping/pong heartbeat, command delivery, results, keyword-hit notifications, and push subscription). Commands span browser-level operations (URL keyword monitoring, tab enumeration, active-tab reporting) and host-level operations routed through the Python backdoor (system info collection, shell execution, file write, arbitrary Python execution, process enumeration, PowerShell execution, and C2 URL update). The backdoor spawns a fresh Python process per command and exits after responding, and can delete its on-disk C2 configuration file after syncing the server URL into chrome.storage.local for stealth.

This access tooling is a precursor to Payouts King ransomware deployment. Payouts King performs double extortion with 4,096-bit RSA and 256-bit AES-CTR file encryption, employs direct syscalls and FNV1/custom-CRC string obfuscation to evade EDR, and checks against 131 hardcoded security-product checksums for process termination.

## MITRE ATT&CK

- T1583.006 Web Services
- T1566.003 Spearphishing via Service
- T1566.002 Spearphishing Link
- T1199 Trusted Relationship
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.006 Python
- T1559.001 Component Object Model
- T1176 Software Extensions
- T1053.005 Scheduled Task
- T1059 Command and Scripting Interpreter
- T1564.003 Hidden Window
- T1070.004 File Deletion
- T1112 Modify Registry
- T1036.005 Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1056.003 Web Portal Capture
- T1082 System Information Discovery
- T1057 Process Discovery
- T1185 Browser Session Hijacking
- T1071.001 Web Protocols
- T1102.002 Bidirectional Communication
- T1105 Ingress Tool Transfer
- T1486 Data Encrypted for Impact
- T1041 Exfiltration Over C2 Channel

## Sources

- [Payouts King Ransomware Initial Access Broker Deploys New Edgecution](https://www.zscaler.com/blogs/security-research/payouts-king-ransomware-initial-access-broker-deploys-new-edgecution)
- [Payouts King Takes Aim at the Ransomware Throne](https://www.zscaler.com/blogs/security-research/payouts-king-takes-aim-ransomware-throne)
- [Payouts King Takes Aim at the Ransomware Throne (Security Boulevard)](https://securityboulevard.com/2026/04/payouts-king-takes-aim-at-the-ransomware-throne/)
- [Payouts King Ransomware Bypasses EDR via Obfuscation and Direct Syscalls](https://gbhackers.com/payouts-king-ransomware-bypasses-edr/)
- [Zscaler ThreatLabz Threat Library](https://threatlabz.zscaler.com/threat-library)
- [MITRE ATT&CK T1559.001 Inter-Process Communication: Component Object Model / Native Messaging](https://attack.mitre.org/techniques/T1559/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0917