PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution

Summary

A new post-exploitation toolkit named PEEP has been discovered that masquerades as a browser extension for Chrome and Edge. It requires prior administrative access to be installed, bypassing web store checks by forging browser preferences. PEEP enables remote command execution, data exfiltration, and credential theft, functioning as a sophisticated backdoor.

Full text

PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution Ravie LakshmananSep 07, 2026Malware / Browser Security Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser. "Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks and user prompts by forging Chromium's own Secure Preferences integrity values," SOCRadar said. "A native-messaging tool then extends it beyond browser telemetry to host-level command execution and file management." Once installed, the PEEP "extension" agent polls its command-and-control (C2) server ("206.237.30[.]232" or "xfjcc[.]fun") every 30 seconds over plaintext HTTP for new commands, while exfiltrating browsing history, active-tab metadata, and session cookies. It also functions as a remote access and browser monitoring toolkit that runs host commands, steals credentials, hijacks sessions, and alters web pages. PEEP is built on the foundations of an open-source, browser data analysis and red teaming framework called RedExt, which has also been put to use in prior GlassWorm attacks. However, it expands on the toolkit with dedicated installation routines, a native host bridge, heartbeat telemetry, an update channel, and a broader command set. This, in turn, makes PEEP a derivative of RedExt. PEEP is described as a post-compromise framework as it lacks an initial access vector itself, meaning it requires the operator to breach a machine through some other means and deploy the malware. The activity remains unattributed, although the presence of Chinese-language artifacts in the source code points to a Chinese-speaking threat actor. The extension masquerades as "Smart Bookmarks" (ID: ejkndncpkdcjcikfhiamcdehdoegilbj). It's the main agent responsible for executing the beacon loop by polling "/api/commands," harvesting browser data, receiving additional tasking, and sending the results back. The browser add-on also invokes an auxiliary executable ("nm_host.exe") when said task requires operating system access, while browser-based commands (e.g., screenshots, clipboard, or JavaScript injection) are run locally. The use of the Native Messaging Host binary transforms the malware from a basic credential stealer to a remote-access tool. "Operating in the user context, the extension extracts browser artifacts and uses com.peep.lab/nm_host.exe to run shell commands, manage files, and discover processes and services," SOCRadar said. "Bypassing Web Store checks, PEEP maintains persistence via sideloading, enterprise force-install policies, preference-integrity manipulation, and a ScriptCache fallback." Also used by the extension are several other endpoints - "/api/register" to register the infection "/api/agents/<id>/heartbeat" to send details about the browser's User-Agent string, operating system, and time zone "/api/extension_update/" and "/api/extension_crx/" to update the extension itself "/api/agents/<id>/task_result" to post the results of the command execution "/api/exfil" to post auto-collected data, such as cookies, recent history, open tabs, active URL, public IP address, locale, and time zone "/health" to serve internal system status without requiring login credentials "/login" to serve a login interface for the C2 panel at port 5001 Another defining aspect of PEEP is its ability to modify the Secure Preferences file to ensure that the extension is auto-enabled upon launching the browser. Given that the extension is not available on the Chrome Web Store and other official extension marketplaces, it also leverages the ExtensionInstallForcelist or ExtensionSettings policies and sideloading tricks for delivery. To aid in this tampering, the malware makes use of two PowerShell scripts - install_silent.ps1, which enables Developer Mode to sideload arbitrary extensions patch_secure_prefs.ps1, which patches the Secure Preferences file force_enable.ps1, which removes the extension from Preferences’s external_uninstalls, places the CRX at %LOCALAPPDATA%PEEPcrx, re-registers via the HKCU Extensions key and an External Extensions JSON manifest, and restarts the browser There also exists a Python script "patch_secure_prefs_linux.py" indicating that the threat actor behind the operation is replicating the behavior to also target Linux environments. Once initialized, the extension parses a configuration file to extract C2 information and activate automated data harvesting, while a companion content script ("content.js") is embedded across all active web pages. SOCRadar said it identified a number of references to "Authorized CTF" use, raising the possibility that the threat actor may have used the framing to lower the safety guardrails of AI tools and assist in malware development. There are currently no signs as to who is being targeted, but the "/health" endpoint shows 34 agent entries, 10 active sessions, and 507 data records. That said, there is no way to differentiate actual infected hosts from test entries or verified deployments. "PEEP builds on existing host compromises, using a native-messaging bridge to convert Chrome/Edge into a persistent backdoor that crosses the browser sandbox to reach the OS," SOCRadar said. "Because its logic runs inside the signed browser process, it slips past detection of keys on new or unsigned binaries. Consequently, the browser acts as an endpoint pivot for credential theft, session abuse, and command execution." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  browser security, endpoint security, Malware, Web Security ⚡ Top Stories This Week Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code Thousands of OpenAI Agents Quietly Turned an Abandoned Wiki Into Their Coordination Channel Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root Thomson Reuters Court Software Breach May Have Exposed SSNs and Sealed Data Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon Fake Software Installers Disable Windows Update and Weaken Microsoft Defender Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another ⭐ Featured Resources See How Keeper S

Indicators of Compromise

• ip — 206.237.30.232
• domain — xfjcc.fun

Entities