Payouts King Ransomware Initial Access Broker Deploys New Edgecution Malware
Zscaler, Tuesday, June 23rd, 2026
ThreatLabz uncovers Edgecution, a malicious Edge extension tied to Payouts King ransomware that escapes the browser sandbox.
Zscaler ThreatLabz identified Edgecution, a malicious Microsoft Edge browser extension linked to Payouts King ransomware operators. The malware abuses Chrome's native messaging protocol to break out of the browser sandbox, giving attackers host-level filesystem access and arbitrary code execution.
The attack chain starts with social engineering over Microsoft Teams, luring victims to fake Microsoft sites where they download obfuscated scripts.
Those scripts launch a hidden browser instance running the malicious extension paired with a Python backdoor for command execution.