A newly exposed threat called PEEP turns Chrome and Edge into persistent backdoors, enabling attackers to run commands on the host system and steal sensitive browser data. Security researchers uncovered this Chromium-based toolkit after observing its ability to inject itself as a bookmarks extension and bypass browser and system protections.
How PEEP Works Under the Hood
PEEP operates as a post-compromise framework—it doesn’t have its own way in, but once a system is breached (via other means), it implants itself into Chrome or Microsoft Edge user profiles. Using forged integrity values in the browser’s Secure Preferences, it sidesteps Web Store checks and user prompts, ensuring the extension is enabled automatically. For more system-level access, it leverages a native messaging bridge.
The extension periodically connects to its command-and-control (C2) infrastructure (for example, the IP address 206.237.30[.]232 or domain xfjcc[.]fun) every 30 seconds over unencrypted HTTP. During these intervals, it exfiltrates browsing history, session cookies, active tab information, and metadata. Additionally, it raises its capabilities: executing arbitrary shell commands, file management, screenshot capture, clipboard access, content script injection, and altering web pages.
Installation, Persistence, and Component Breakdown
The main payload is disguised as “Smart Bookmarks” with an extension ID of ejkndncpkdcjcikfhiamcdehdoegilbj. When more privileged actions are required, it installs a native executable (nm_host.exe) and bridges to system commands via the native messaging host mechanism. Detecting malicious browser activity only scratches the surface; once the native component is present, PEEP affects the fundamental operating system.
To persist across restarts and evade user intervention, the threat actor uses methods like sideloading, enterprise force-install policies, manipulated Secure Preferences files, ScriptCache fallbacks, PowerShell scripts to enable developer mode, patch preference files, force enable the extension, and even external extensions JSON manifests via HKCU registry keys. A Linux version appears under development, with a Python script that mimics preference file tampering.
Origins, Attribution, and Scale
PEEP builds upon an earlier open-source red teams tool called RedExt, known for monitoring browser data and previously tied to operations like GlassWorm. What distinguishes PEEP are its dedicated installer routines, native host bridge, telemetry, auto-update channel, and expanded commands beyond RedExt’s baseline.
Although the specific threat actor remains unknown, code artifacts in Chinese suggest a Chinese-language speaker may be involved. The framework itself requires an earlier breach for deployment—hacking or other access into the system is not part of PEEP’s toolkit. Current telemetry shows at least 34 agent entries and 10 active sessions communicating via the C2, along with hundreds of collected data records. It’s unclear whether these represent real victim machines or test environments.
Why This Matters & What to Watch
Browsers like Chrome and Edge have long been considered safer entry points, constrained by their sandboxed environments. PEEP shatters that assumption, turning the browser into a launchpad for system-level attacks. The melding of browser extension and native host capabilities enables credential theft, session hijacks, and remote code execution—all under the radar of many endpoint protections.
Enterprises relying on force-installed extensions or policies should review their extension-management settings. Users should check for unfamiliar extensions, validate their Secure Preferences files, and monitor for uncommon executables like nm_host.exe. Keeping browsers up to date remains crucial, as does restricting developer mode and sideloading of untrusted extensions.
As browser-based attacks evolve, this demonstrates the growing importance of considering the browser itself as part of the threat perimeter—not just web content. PEEP is a reminder that post-compromise persistence technologies are becoming more stealthy and powerful. Security teams must begin treating browser extensions, policy enforcement, and native messaging bridges with the same scrutiny once reserved for traditional malware and rootkits.
