native_host.bat launches python.exe with -u flag under msedge.exe

Duo Tech@duotech

•updated Aug 5, 2026•2•0•8

Detects the Edgecution native messaging host chain where a batch wrapper (native_host.bat), spawned by msedge.exe, launches python.exe with the unbuffered output flag (-u) to run the malicious native_host.py backend used for C2 command execution.