Malicious Edge Extension Abuses Native Messaging to Deploy Ransomware

Attackers distributed a malicious Microsoft Edge extension ('Edgecution') by impersonating IT support staff on Microsoft Teams, tricking users into downloading what appeared to be a legitimate software update. The extension exploited the Chrome Native Messaging protocol — a legitimate browser feature — to escape the browser sandbox and install a Python-based backdoor, effectively turning a trusted mechanism into an attack vector. This attack succeeded largely because users lacked awareness of social engineering tactics and organizations failed to restrict which browser extensions could be installed or which native messaging hosts were permitted. The abuse of trusted internal communication platforms like Teams amplifies the risk, as employees are conditioned to trust IT-related messages received there. This highlights how attackers increasingly weaponize legitimate software features and trusted channels to evade both technical controls and user suspicion.

Tactical Insight

Immediate actions

Audit and restrict browser extension installations to an approved allowlist via Group Policy or MDM for all managed devices.
Disable or restrict Native Messaging host permissions for browsers where the feature is not required for business operations.
Alert employees to verify any IT support requests received via Teams through a secondary, confirmed channel before downloading software.

Long-term improvements

Enforce application allowlisting to prevent unauthorized Python interpreters or scripts from executing on endpoints.
Implement Microsoft Teams governance policies that restrict external contacts and flag messages containing download links for review.
Establish a formal browser hardening baseline (e.g., based on CIS Benchmarks for Edge/Chrome) and enforce it across all managed endpoints.

Detection measures

Monitor for unusual Native Messaging host registrations and unexpected parent-child process relationships spawned from browser processes.
Deploy endpoint detection and response (EDR) tooling configured to alert on Python script execution in user-writable directories.
Log and review all Teams messages containing external URLs and correlate with subsequent download or execution events on endpoints.

Framework References

CIS Control 2: Inventory and Control of Software AssetsCIS Control 4: Secure Configuration of Enterprise Assets and SoftwareCIS Control 9: Email and Web Browser ProtectionsCIS Control 14: Security Awareness and Skills TrainingNIST SP 800-53 CM-7: Least FunctionalityNIST SP 800-53 SI-3: Malicious Code ProtectionNIST SP 800-53 AT-2: Literacy Training and AwarenessNIST SP 800-53 AC-6: Least PrivilegeMITRE ATT&CK T1176: Browser ExtensionsMITRE ATT&CK T1559: Inter-Process Communication (Native Messaging)MITRE ATT&CK T1566.002: Phishing – Spearphishing LinkNIST CSF DE.CM-1: Network MonitoringGDPR Article 32: Security of Processing (where PII may be exfiltrated)

Source

ThreatNoir coverageMalicious Edge extension abuses Native Messaging as bridge to malware Read originalMalicious Edge extension abuses Native Messaging as bridge to malware

PublishedJun 24, 2026