PEEP: Chromium Extension Turned Post-Compromise Backdoor

PEEP is a Chromium-based post-exploitation toolkit that masquerades as a bookmarks extension and turns Chrome and Edge into a backdoor for stealing data and running commands on the host, according to research from SOCRadar. It is a post-compromise framework, meaning it has no initial-access method of its own: the operator must already have administrative or code-execution access to a machine, and PEEP's installer then injects the extension directly into Chrome or Edge profiles. It does this by forging Chromium's own Secure Preferences integrity values, bypassing Web Store checks and the user prompts that normally gate extension installs.

Once installed, the fake extension, which poses as "Smart Bookmarks," polls its command-and-control server, at 206.237.30[.]232 or xfjcc[.]fun, every 30 seconds over plaintext HTTP for new commands, while exfiltrating browsing history, active-tab metadata, and session cookies. A companion native-messaging component invokes an auxiliary executable, nm_host.exe, that extends PEEP beyond the browser into host-level command execution and file management. In practice it functions as a remote-access and browser-monitoring toolkit that runs commands, steals credentials, hijacks sessions, and can alter web pages.

PEEP is built on RedExt, an open-source browser data-analysis and red-teaming framework that was also used in prior GlassWorm attacks, but it adds dedicated installation routines, a native-host bridge, heartbeat telemetry, an update channel, and a broader command set. The activity is unattributed, though Chinese-language artifacts in the source code point to a Chinese-speaking threat actor.

How does PEEP bypass the browser's extension protections?

By faking the integrity data the browser uses to trust installed extensions. Chromium stores a Secure Preferences file with signed integrity values so it can detect tampered or side-loaded extensions. PEEP's installer forges those values, so Chrome and Edge accept the injected "Smart Bookmarks" extension as legitimate without the Web Store review or the user consent prompt that normally protect against unwanted add-ons. Because this requires writing to the profile, it depends on the attacker already having the access PEEP assumes.

Why does a browser make such a useful backdoor?

Because the browser holds the keys to a user's digital life and is expected to talk to the internet constantly. Session cookies, saved credentials, and active tabs let an attacker impersonate the user in web applications without triggering a fresh login, and the browser's normal outbound traffic gives malicious beacons cover. Extending from the browser into host command execution via native messaging then turns a browser foothold into full endpoint control.

Our read

PEEP is a reminder that the browser is now a first-class endpoint to defend, not just an app. It does not break in on its own, but once an attacker has a foothold, turning Chrome or Edge into a persistent, low-noise backdoor gives them cookies, sessions, and a path to host commands, all under the cover of normal browsing. The defensible response is to treat browser profiles as sensitive assets: monitor for unexpected extensions and Secure Preferences tampering, restrict native-messaging hosts, and, because PEEP is a post-compromise tool, invest in detecting the initial breach that has to happen first. Assuming an attacker will target the browser is the safer default.

Reporting by The Hacker News; technical analysis per SOCRadar. Sources linked above.

Related: What is a web shell? and What is MCP security?.