TLDR Tech / InfoSec
Malicious Edge Extension Abuses Native Messaging as Bridge to Malware
Zscaler researchers are warning of a malicious Microsoft Edge extension dubbed Edgecution that utilizes the Chrome Native Messaging protocol to communicate with a Python-based backdoor. The attackers pose as IT support personnel on Microsoft Teams and direct a user to a fake Microsoft “Outlook Updates Management Console,” which the attacker can use to install the malware via an AutoHotkey, batch, or PowerShell script. The malware resembles the tradecraft of an initial access broker connected with the Payouts Kings ransomware operation.
Read the full story