[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRBhsh9RcDNTqJSFFCwswyvCF8MOEmWxGFyMQXKCGGao":3},{"article":4,"iocs":55,"watch_terms":62,"solutions":63,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"6071f09d-112e-473e-b9c4-07a8073c3e7a","Malicious Edge extension abuses Native Messaging as bridge to malware","malicious-edge-extension-abuses-native-messaging-as-bridge-to-malware-9fda4c","A malicious Microsoft Edge extension dubbed 'Edgecution' has been used in a ransomware attack to escape the browser sandbox and deploy a Python-based backdoor. [...]","A new malicious Microsoft Edge extension called 'Edgecution' has been observed being used in a ransomware attack. It leverages the Chrome Native Messaging protocol to bypass the browser sandbox and deploy a Python-based backdoor. Attackers are distributing this through fake IT support lures on Microsoft Teams, directing victims to fraudulent websites that download the malware disguised as software updates.","Malicious Edge extension 'Edgecution' uses Native Messaging to deploy ransomware backdoor.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmalicious-edge-extension-abuses-native-messaging-as-bridge-to-malware\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F06\u002F24\u002Fedge.jpg","2026-06-24T20:58:22+00:00","2026-06-24T22:00:12.68039+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Microsoft Edge","product",{"name":21,"type":22},"Native Messaging","technology",{"name":24,"type":19},"Microsoft Teams",{"name":26,"type":19},"Microsoft 365",{"name":28,"type":19},"Outlook",{"name":30,"type":31},"Zscaler","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,59],{"type":36,"value":57,"context":58},"Edgecution","Malicious Microsoft Edge extension and backdoor",{"type":36,"value":60,"context":61},"Payouts Kings","Ransomware operation linked to Edgecution",[30,18,24],{"controls":64,"vendors":152},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":95,"name":96,"problem":97,"products":98},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":124,"name":125,"problem":126,"products":127},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",[153,156],{"slug":71,"name":72,"logo_path":73,"roles":154},[155],"affected",{"slug":157,"name":30,"logo_path":158,"roles":159},"zscaler","\u002Fvendor-logos\u002Fzscaler.png",[160],"reported_by",{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":179},"malicious-edge-extension-abuses-native-messaging-to-deploy-ransomware","Malicious Edge Extension Abuses Native Messaging to Deploy Ransomware","Attackers distributed a malicious Microsoft Edge extension ('Edgecution') by impersonating IT support staff on Microsoft Teams, tricking users into downloading what appeared to be a legitimate software update. The extension exploited the Chrome Native Messaging protocol — a legitimate browser feature — to escape the browser sandbox and install a Python-based backdoor, effectively turning a trusted mechanism into an attack vector. This attack succeeded largely because users lacked awareness of social engineering tactics and organizations failed to restrict which browser extensions could be installed or which native messaging hosts were permitted. The abuse of trusted internal communication platforms like Teams amplifies the risk, as employees are conditioned to trust IT-related messages received there. This highlights how attackers increasingly weaponize legitimate software features and trusted channels to evade both technical controls and user suspicion.",[166,167,168,169,170,171,172,173,174,175,176,177,178],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 AC-6: Least Privilege","MITRE ATT&CK T1176: Browser Extensions","MITRE ATT&CK T1559: Inter-Process Communication (Native Messaging)","MITRE ATT&CK T1566.002: Phishing – Spearphishing Link","NIST CSF DE.CM-1: Network Monitoring","GDPR Article 32: Security of Processing (where PII may be exfiltrated)",{}]