A browser extension is supposed to be trapped inside the browser. A backdoor called Edgecution is a working demonstration that "supposed to be" was doing a lot of the work. It runs inside a Microsoft Edge window the victim never opened and cannot see, and it uses a feature built into every Chromium browser to run commands on the machine underneath.

Picture the new hire in accounts, three weeks in, still saying yes to things. A message arrives in Microsoft Teams from someone whose name is listed under IT support. There is a spam-filter update for Outlook; the mail team is rolling it out this week; here is the page. She opens it. It is branded as an "Outlook Updates Management Console," it looks internal enough, and it gives her a short command to run to finish the install. She runs it. Nothing seems to happen. She closes the tab and gets back to work.

In late June, Zscaler's ThreatLabz team documented what happens after she closes that tab. The malware family is Edgecution, and BleepingComputer covered it the same week. The malware is quiet by design; the part worth a closer look is where the attacker chose to hide it.

A message from IT that wasn't.

The opening move is social engineering over Microsoft Teams, with the attacker posing as the company's own IT staff and steering the employee to that fake Outlook update page. The page offers three ways to "finish the install," and per Zscaler's breakdown they all deliver the same thing: an obfuscated AutoHotKey script bundled with a real AutoHotKey executable, a Windows batch script copied to the clipboard, or a PowerShell script copied to the clipboard. Two of those three are the clipboard-paste move you may know as ClickFix — the page writes the command for you, and the only thing left for the human to do is paste and press Enter.

That paste is the whole ballgame. The payload arrives inside an encrypted ZIP with its PK magic bytes stripped off, so that the file does not look like a ZIP to anything scanning it. Once the script runs, the host is compromised — not by a clever exploit, but because a person was talked into running a program on their own computer. Everything after this is the attacker deciding how to stay.

The browser as a backdoor.

The way it survives a reboot is the part worth slowing down on. Most malware that wants to persist drops an executable, writes a registry run-key, or installs a service — all things security tools are built to watch. Edgecution does something quieter. The setup script schedules a Windows task that launches Microsoft Edge with a handful of command-line flags, including --load-extension to side-load the attacker's own extension and --headless=new so the browser window is never drawn on screen. There is now a Microsoft Edge process running on the machine — a signed, trusted, ordinary program — that the user cannot see and did not start.

Inside that invisible browser, the extension does two things. It beacons out to a command-and-control server (the address attackers use to send instructions) over a WebSocket hosted on Amazon CloudFront, so the traffic looks like a normal browser talking to a normal content network. And it relays the commands it receives down to the host using Native Messaging.

Native Messaging is a real, documented Chromium feature, working as designed. It is the channel that lets a browser extension talk to a desktop program installed on the same machine — the mechanism an extension uses to hand work to its companion desktop app, for example. An extension calls chrome.runtime.sendNativeMessage, and the browser launches a small "native host" program named in a manifest file and pipes JSON to it. Edgecution registers its own native host: a native_host.bat that starts a Python backdoor. From there the backdoor can run shell commands, run PowerShell, run arbitrary Python, read and write files, list running processes, and report system information back up the chain — everything you need to be the initial-access broker who hands a clean foothold to a ransomware crew. Zscaler ties this operator's tradecraft to the Payouts King ransomware operation.

Edgecution's chain. The victim is talked into running a script (step 3) — the host is compromised there. From that foothold the malware launches a Microsoft Edge window it keeps hidden, side-loads its own extension, and uses Native Messaging — the legitimate channel an extension uses to talk to a desktop program — to run commands on the host through a Python backdoor. Source: Zscaler ThreatLabz.

Notice what is not in that picture: no new service, and no dropped .exe sitting on disk waiting to be flagged. The thing executing the attacker's commands is python.exe launched by a batch file launched by Microsoft Edge — and the traffic carrying those commands is a browser talking to a CDN. It blends in because almost every part of it is a legitimate thing doing a legitimate-looking action.

The headlines called this a sandbox escape. The precise version: the host was already compromised the moment the employee ran the script. Native Messaging is not a hole the attacker broke through; it is a door the browser ships with, and the attacker walked through it. The distinction points to where the real fix has to live. You do not patch your way out of a feature working as designed. You change where the door opens onto.

What "the bridge to the host" reaches in Bromure.

Bromure is a security-first browser. Each tab runs inside a disposable Linux VM (virtual machine — its own separate computer) on your Mac, and the VM is wiped when you close the window. That one architectural choice changes what the rest of the Edgecution story means on your machine.

Start with Native Messaging, the crux of the whole attack. In a normal browser, the "native host" an extension talks to is a program on your operating system — the same operating system that holds your files, your keychain, and your network shares. The bridge is open-ended: any extension can register a native host, and that host can be anything. Edgecution's entire trick depends on the browser and your files sitting on the same machine.

In Bromure, the browser is not on that machine. It runs inside the disposable VM, so the operating system underneath the browser is the throwaway Linux guest, not macOS. A rogue native host registered by something inside the VM would be a program inside the VM — talking to a computer that contains none of your life and ceases to exist when you close the window. The narrow set of bridges that do reach across to macOS are first-party and baked into the read-only disk image: the credential bridge, for instance, fills passkeys and passwords from your Mac's Keychain. There is no way for a running session to add a new one, because — and this is the second half of the answer — you cannot install extensions at all.

Same extension, same Native Messaging call. On the left, the bridge connects the browser to the operating system that holds your files. In Bromure, the browser runs inside a disposable VM, so the bridge reaches the guest's throwaway Linux — and you could not have installed the extension in the first place. The few bridges that do reach macOS (passkeys and passwords from Keychain) are first-party and built into the image.

The blocking is not a setting a phishing page can talk you past. In Bromure's browser policy, chrome://extensions and the Web Store are on a hard blocklist, and there is no developer mode, no "load unpacked," no advanced toggle to get around it. There is also no way to do what Edgecution does on the host side — launch a second Chromium with --load-extension pointed at your real profile — because your real profile is not a folder on your Mac that a stray process can aim a browser at. It is sealed inside the VM.

There is one more thread worth pulling, because it is the cheapest win in the whole story. The lure arrived in Microsoft Teams. A lot of people now use Teams, Outlook, and Slack as web apps. If that habit lives inside a disposable Bromure tab, the impersonation message, the link, and the fake "Outlook update" page all land in an isolated session from the first second — and the chain we just walked through never gets to step three, because the page that wants you to run a script is sitting in a VM that cannot reach your shell. The attack that needs the host never meets the host.

What this does not solve.

Isolation is not a spell, and its limits are worth stating plainly.

A command you run yourself

The entry point here is a human running a script — a batch or PowerShell command copied to the clipboard, or an AutoHotKey executable. If you paste a command into your own shell and press Enter, no browser isolation is in that loop. Clipboard sharing between the VM and your Mac is on by default because copy-and-paste is part of normal browsing; you can switch a profile to full isolation, and the phishing layer is there to flag the page before you act. But the durable rule is older than any of this: never run a command a web page handed you.

Windows binaries, a portable technique

Edgecution targets Microsoft Edge on Windows, and those exact files will not run on a Mac. That is cold comfort, not a defense. Native Messaging is a Chromium feature on macOS too, and the same week brought a macOS campaign that talked users into pasting a Terminal command to drop the Atomic infostealer. The technique is portable; only the binaries are OS-specific.

What Bromure changes is narrower and, we think, more useful than a promise that nothing bad can ever reach you. It removes the conditions that made Edgecution quiet and durable. The browser is no longer a permanent, trusted process sitting next to your files. Native Messaging is no longer an open-ended bridge any extension can register — extensions cannot be added at all, and the browser's own operating system is a throwaway. And persistence, the thing this whole architecture was built to achieve, has nothing to persist into: close the window and the machine the backdoor lived in is gone.

The dangerous browser is the one you can't see.

For twenty years the security advice about browsers has been about the window in front of you — check the address bar, look for the padlock, do not click strange links. Edgecution is a small reminder that the browser doing the damage is more and more the one you never see: a headless process, started by a scheduled task, talking to a CDN, running an extension you did not install. You cannot inspect the address bar of a window that was never drawn.

The question is no longer whether the window in front of you is safe. It is what any browser on this machine can reach, if it is turned against you. On an ordinary computer, the answer is your files, through a bridge it ships with. On a machine running Bromure, the answer is: a disposable Linux box that forgets everything the moment you are done with it. That is the difference worth having. Install it, make it your default for the half of your browsing you do not trust, and let the hidden windows open onto something you were going to throw away anyway.