PEEP Malware Turns Chrome and Edge Into Host-Level Backdoors

SOCRadar researchers have disclosed details on PEEP, a sophisticated post-exploitation toolkit that transforms Chromium-based browsers into covert backdoors for host-level command execution. Disguised as a "Smart Bookmarks" extension (ID: ejkndncpkdcjcikfhiamcdehdoegilbj), PEEP bypasses Chrome Web Store checks by forging Chromium's Secure Preferences integrity values, allowing it to be silently sideloaded into Chrome and Edge profiles after an attacker has already obtained administrative access to the target machine.

Once deployed, the extension functions as a persistent beacon, polling its command-and-control servers at 206.237.30[.]232 and xfjcc[.]fun every 30 seconds over plaintext HTTP. It communicates via endpoints including /api/commands, /api/register, /api/agents//heartbeat, /api/extension_update/, and /api/extension_crx/, harvesting browsing history, active-tab metadata, and session cookies while awaiting new tasking. Security teams investigating suspicious endpoints should run a DNS leak test on affected hosts to confirm whether DNS queries are leaking outside the corporate network and exposing C2 contact attempts.

The toolkit's most dangerous capability comes from its auxiliary native messaging executable, com.peep.lab/nm_host.exe, which extends the extension's reach from browser telemetry to full host-level command execution, file management, and process and service discovery. Browser-native commands such as screenshots, clipboard access, and JavaScript injection run locally, while system-level operations are offloaded to the native host bridge—effectively converting a basic credential stealer into a remote-access trojan. PEEP builds on the open-source RedExt framework, previously seen in GlassWorm campaigns, and adds dedicated installation routines, heartbeat telemetry, an update channel, and a broader command set.

Because PEEP lacks an initial access vector, operators must compromise machines through other means before deploying it. Persistence is maintained through sideloading, enterprise force-install policies, preference-integrity manipulation, and a ScriptCache fallback. The activity remains unattributed, though Chinese-language artifacts embedded in the source code suggest a Chinese-speaking threat actor. Defenders can assess their browser-side exposure by running a browser fingerprint test to see how much identifying data their browser leaks, and should audit installed extensions, monitor outbound traffic to the identified C2 infrastructure, and verify the integrity of Chromium preference files across managed endpoints.