Payouts King: The Fake Teams Support That Installs Edgecution via Quick Assist

Zscaler ThreatLabz documented a campaign named Edgecution, run by an access broker tied to the Payouts King ransomware. Its interest lies in two details: the entry vector, fake IT support on Microsoft Teams coupled with Quick Assist, and the final payload, a Microsoft Edge extension that manages to escape the browser sandbox to take control of the host. It is a chain built entirely on legitimate tools, which makes it particularly stealthy.

The vector: Teams plus Quick Assist

The attack opens with a Microsoft Teams message where the sender poses as the company IT department and claims a spam filter needs updating. The victim is invited to join a Teams call, then to launch Quick Assist, the remote assistance tool built into Windows. Once the assistance session is established, the attacker drops the payload. This is T1219 (Remote Access Software) preceded by internal-messaging phishing, T1566.

This pattern is formidable because Quick Assist is a legitimate Microsoft tool, present by default, often used by real IT departments. Telling it apart from malicious use requires looking at context: Quick Assist launched shortly after an unsolicited Teams contact, followed by script execution and archive drops.

The install scripts unpack a disguised, encrypted ZIP archive containing a bundled Python runtime, the malicious extension, and a backdoor.

The payload: an Edge extension that escapes the sandbox

The technical core of Edgecution is a malicious Microsoft Edge browser extension that exploits the Chrome native messaging protocol to interact with host applications beyond the confines of the browser sandbox. This is T1176 (Browser Extensions). Native messaging is a legitimate mechanism that lets an extension communicate with a program installed on the machine. Abused, it gives the extension a bridge to the host: local filesystem manipulation, process launching, arbitrary code execution.

The stable detection point here is the registration of a native messaging host pointing to a non-standard executable, and msedge.exe launching an unusual host process such as an embedded Python interpreter.

Two Sigma rules for the chain

The first rule watches for Quick Assist launching, to be correlated with Teams activity to clear the doubt.

title: Quick Assist launched on a host (correlate with Teams contact)
id: 8c1f4a26-3d70-4b95-9e2a-6f0b7c1d5e38
status: experimental
description: >
  Detects quickassist.exe launching, a remote assistance tool abused by the
  Edgecution campaign after a fake support contact on Teams.
references:
  - https://www.zscaler.com/blogs/security-research/payouts-king-takes-aim-ransomware-throne
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\quickassist.exe'
  condition: selection
falsepositives:
  - Legitimate use by IT support, correlate with a declared ticket
level: medium
tags:
  - attack.command_and_control
  - attack.t1219

The second targets native messaging abuse: Edge launching an unsigned host process or one located in a user path, a marker of the extension crossing the sandbox.

title: Edge launches a suspicious native messaging host
id: 2f9d3b71-6a04-4c18-8e5f-1c7b0d9e2a46
status: experimental
description: >
  Detects msedge.exe launching a host process from a user path or an embedded
  runtime, the native messaging abuse pattern (Edgecution).
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\msedge.exe'
    Image|contains:
      - '\AppData\'
      - '\Temp\'
    Image|endswith:
      - '\python.exe'
      - '\pythonw.exe'
  condition: selection
falsepositives:
  - Rare, legitimate extensions using a properly installed native host
level: high
tags:
  - attack.persistence
  - attack.t1176

The measures that break the chain

Three controls sharply reduce the risk. First, restrict Quick Assist: if your support does not use this tool, it can be disabled, which neutralizes the entry vector. Second, limit inbound Teams messages from external organizations, since the fake support often relies on external tenants posing as the IT department. Finally, govern browser extension installation with an enterprise policy, allowing only approved extensions, which blocks the drop of a malicious extension even if the host is reached.

The through-line, as with ClickFix, is that the attack shifts execution to the legitimate user via trusted tools. Detection therefore is not about a malicious binary, but about the contextual sequence: external contact, assistance tool, extension, native bridge.

That is exactly the approach of the ThreatClaw Sigma feed: rules built on behavioral sequences and execution context, tested before release to stay operable without drowning the team in false positives.