Malicious Edge extension abuses Native Messaging as bridge to malware

Attackers distributed a malicious Microsoft Edge extension ('Edgecution') by impersonating IT support staff on Microsoft Teams, tricking users into downloading what appeared to be a legitimate software update. The extension exploited the Chrome Native Messaging protocol — a legitimate browser feature — to escape the browser sandbox and install a Python-based backdoor, effectively turning a trusted mechanism into an attack vector. This attack succeeded largely because users lacked awareness of social engineering tactics and organizations failed to restrict which browser extensions could be installed or which native messaging hosts were permitted. The abuse of trusted internal communication platforms like Teams amplifies the risk, as employees are conditioned to trust IT-related messages received there. This highlights how attackers increasingly weaponize legitimate software features and trusted channels to evade both technical controls and user suspicion.