Threat Actor Uses Phishing to Breach Orgs for Ransomware Gangs

Zscaler researchers report that an initial access broker associated with the Payouts King ransomware gang is using Microsoft Teams phishing to trick victims into installing a malicious Microsoft Edge extension. The extension abuses the Chrome native messaging protocol to escalate beyond the browser sandbox, allowing attackers to manipulate files, launch processes, and execute arbitrary code; the broker then sells the foothold to the ransomware group. Organizations are advised to monitor browser extension installations, control native messaging hosts, and train users to recognize spoofed IT prompts.