Edgecution — Malicious Microsoft Edge Extension Backdoor

What it is. Edgecution (named by Zscaler ThreatLabz) is a malicious Microsoft Edge extension used as an initial-access foothold. The attacker poses as IT support on Microsoft Teams and steers the user to a fake "Outlook Updates Management Console" page — a ClickFix lure — which drops an obfuscated AutoHotKey script and an encrypted ZIP (PK magic bytes stripped). The payload installs an Edge extension ("Edge Monitoring Agent") that abuses the Chrome Native Messaging protocol as a bridge out of the browser sandbox to a batch launcher (native_host.bat) which starts an embedded Python 3.13.3 backdoor.

Why it matters. The extension component beacons to C2 over WebSocket (WSS) fronted by AWS CloudFront — blending with legitimate CDN traffic — while the Python backdoor delivers full host control: shell and PowerShell execution, arbitrary Python, file write, and process enumeration. To stay invisible, the extension is loaded into a headless Edge instance via a scheduled task, so there is no visible browser window. The operator is assessed to be an initial-access broker tied to the Payouts King ransomware operation — Edgecution is the front door; ransomware is the likely follow-on.

The hunt is favorable. Unlike an appliance exploit, Edgecution runs entirely on the endpoint and leaves crisp, high-fidelity artifacts: a headless msedge.exe launched with --load-extension + --headless=new against a non-default --user-data-dir; msedge.exe spawning cmd.exe/python.exe via native messaging; files under %LOCALAPPDATA%\Microsoft\Edge\User Data\test1; an AppKey value under HKCU\SOFTWARE\Microsoft\Edge; and WSS beacons to four specific CloudFront hosts. Published SHA256 hashes exist for both components.

Defender priority: A browser is not supposed to spawn a shell. Hunt msedge.exe loading an unpacked extension into a headless, non-default profile and any Edge → cmd/python/powershell parent-child chain — that single behavioral pair is the highest-value, lowest-FP catch, independent of the (perishable) C2 domains and hashes.

Intel gaps / perishability: C2 lives on AWS CloudFront, so the four *.cloudfront.net hosts are rotatable and will expire quickly — hunt them but do not rely on them long-term. The randomized native-messaging host name (com.[rand].api) varies per campaign, so match on the path/behavior rather than the exact host name. The two SHA256 hashes are point-in-time; the behavioral hunts (§8) are the durable coverage.

Hunt hypotheses (fidelity-ordered)

Attack chain

Microsoft Edge / browser management

• Unpacked extensions: via Edge management (or on-host) enumerate extensions loaded with --load-extension / developer mode. Any extension outside the managed allowlist — especially "Edge Monitoring Agent" — is suspect.
• Native messaging hosts: inspect %LOCALAPPDATA%\Microsoft\Edge\User Data\**\native\ and the NativeMessagingHosts manifests for a host that points at a .bat (legit hosts point at signed executables). Edgecution's manifest points at native_host.bat.
• Rogue profile dirs: look for non-standard Edge User Data profile folders (test1, Recovery) created outside normal profile setup.

Microsoft 365 / Teams

• Hunt Teams for external/guest senders impersonating "IT Support"/"Help Desk" that message multiple internal users, and for chats containing links to non-corporate "update/console" domains.
• Proxy/secure-web-gateway: alert on downloads of .ahk / AutoHotKey binaries and on fetches to newly-registered "Outlook/Office update" lookalike domains.

Network

• On the SWG/firewall, log WSS (wss://) upgrades to *.cloudfront.net from user endpoints and match against the four known hosts; more broadly, flag long-lived WebSocket sessions to CloudFront from processes other than a normal foreground browser.

Playbook A — Edge extension & native-messaging lockdown (GPO / Intune ADMX)

# Microsoft Edge policies (HKLM\SOFTWARE\Policies\Microsoft\Edge):
ExtensionInstallBlocklist        = ["*"]
ExtensionInstallAllowlist        = ["<approved_ext_id_1>","<approved_ext_id_2>"]
BlockExternalExtensions          = 1
NativeMessagingBlocklist         = ["*"]
NativeMessagingAllowlist         = ["com.google.chrome.example","<approved_host>"]
DeveloperToolsAvailability       = 2      # 2 = disallowed
# Deploy via GPO (Administrative Templates > Microsoft Edge) or Intune Settings Catalog.

Playbook B — Hunt & clean an infected host (PowerShell)

# 1. Detect the rogue load / install
Get-CimInstance Win32_Process -Filter "Name='msedge.exe'" |
  Where-Object { $_.CommandLine -match '--load-extension|--headless' } |
  Select-Object ProcessId, CommandLine

Test-Path "$env:LOCALAPPDATA\Microsoft\Edge\User Data\test1"
Get-ItemProperty "HKCU:\SOFTWARE\Microsoft\Edge" -Name AppKey -ErrorAction SilentlyContinue

# 2. Remove persistence + artifacts (after evidence capture)
Get-ScheduledTask | Where-Object { $_.Actions.Arguments -match '--load-extension|--headless' } |
  Unregister-ScheduledTask -Confirm:$false
Remove-Item "$env:LOCALAPPDATA\Microsoft\Edge\User Data\test1" -Recurse -Force -ErrorAction SilentlyContinue
Remove-ItemProperty "HKCU:\SOFTWARE\Microsoft\Edge" -Name AppKey -ErrorAction SilentlyContinue

Playbook C — Block C2 & hashes (Falcon IOC import)

# Import the §10 CSV via Falcon > Endpoint Security > IOC Management,
# or the API:  POST /iocs/entities/indicators/v1
#   domains  -> detect   (4 CloudFront hosts)
#   sha256   -> prevent  (background.js + Python backdoor)
# Refresh the domain set as CloudFront infrastructure rotates.

Known gaps: the Teams lure (T1566.002) is off-EDR — close it with M365/Teams audit + proxy hunts (§7). C2 domains are CloudFront-fronted and will rotate; the behavioral queries (Q1/Q2/Q3/Q6) are the durable coverage.

Validation: the telemetry-ready and benign-baseline gates (§11) must pass before Q2/Q7 are promoted from Investigate to Detect/Block.