The disclosure of PEEP highlights an increasingly important shift in post-exploitation tradecraft: attackers are no longer satisfied with stealing browser data and moving on. They are beginning to turn the browser itself into a persistent command-and-control and execution platform. PEEP is a Chromium-based post-exploitation toolkit that masquerades as a bookmarks extension and targets Google Chrome and Microsoft Edge. According to SOCRadar, the framework requires the attacker to already have administrative access or code execution on the endpoint, so it is not a remote browser exploit or initial-access vulnerability. Once deployed, however, it injects itself directly into Chrome or Edge profiles, bypasses normal Web Store checks and user prompts, and establishes a persistent extension capable of browser surveillance, credential theft, session hijacking and host-level command execution. 

The distinction between initial access and post-exploitation is important because it changes how PEEP should be understood defensively. An attacker cannot simply send a victim to a malicious webpage and automatically install the extension through a Chrome vulnerability. They first need sufficient access to the Windows host to manipulate the browser’s profile and configuration. Once that access exists, PEEP is designed to make the compromise more persistent, more useful and potentially harder to detect. In other words, PEEP is not the tool that necessarily opens the door. It is what the attacker installs after getting inside so that the browser becomes another door they control.

The toolkit’s installation mechanism is particularly interesting because it attacks Chromium’s extension trust model from underneath rather than trying to persuade the browser to accept a malicious extension through normal user interaction. The malicious extension, identified as “Smart Bookmarks” with extension ID `ejkndncpkdcjcikfhiamcdehdoegilbj`, is not distributed through the Chrome Web Store. Instead, PEEP modifies Chromium configuration and preference data so that the browser treats the extension as legitimate and automatically enables it. The framework can manipulate Chrome’s Secure Preferences integrity values, use enterprise `ExtensionInstallForcelist` or `ExtensionSettings` policies and employ sideloading techniques to ensure the extension remains installed.

That abuse of Secure Preferences deserves particular attention. Chromium uses integrity mechanisms around preference files partly to detect unauthorized changes to sensitive configuration. PEEP includes tooling specifically designed to patch those values after modifying the browser configuration, effectively attempting to make attacker-created changes look consistent with what Chromium expects. The result is a useful lesson for defenders: application integrity controls are considerably less useful once an attacker already possesses enough operating-system privilege to alter both the protected configuration and the metadata used to verify it.

PEEP uses multiple PowerShell scripts to automate the installation and persistence process. `install_silent.ps1` enables Developer Mode and permits arbitrary extension sideloading, while `patch_secure_prefs.ps1` modifies the browser’s Secure Preferences file. Another script, `force_enable.ps1`, removes the malicious extension from Chrome’s `external_uninstalls` list, copies the CRX package into `%LOCALAPPDATA%\PEEP\crx`, registers it through the Windows registry and an External Extensions manifest, and restarts the browser. SOCRadar also identified a Python script called `patch_secure_prefs_linux.py`, suggesting that the developers have at least explored reproducing the same persistence technique on Linux systems.

Once installed, the extension becomes a persistent browser implant. It contacts command-and-control infrastructure every 30 seconds over plaintext HTTP, using infrastructure reported as `206.237.30[.]232` and `xfjcc[.]fun`. It registers the infection, sends heartbeat telemetry and retrieves commands from the C2 server. The browser agent can automatically exfiltrate cookies, recent browsing history, open tabs, active URLs, public IP information, locale, operating-system information and time-zone data.

The theft of session cookies is particularly important. A compromised browser can expose much more than browsing history. Users routinely remain authenticated to corporate email, SaaS applications, cloud platforms, identity providers and administrative services. If an attacker can obtain valid session cookies, they may be able to hijack those authenticated sessions without needing to repeat the original login process. Strong passwords and MFA remain important, but neither necessarily protects an authenticated session after the endpoint holding its session material has already been compromised.

PEEP’s capabilities extend far beyond passive browser-data theft because it also uses Chromium’s Native Messaging mechanism. The extension communicates with a companion executable called `nm_host.exe`, identified through a native messaging host named `com.peep.lab`. Native Messaging is a legitimate Chromium feature that allows extensions to communicate with applications running on the local operating system. PEEP abuses that bridge to cross from the browser context into the host environment. The native component can execute shell commands, manage files and discover running processes and services.

This transforms PEEP from a malicious extension into something much closer to a full remote-access framework. Commands that only require browser functionality, such as clipboard access, screenshots or JavaScript injection, can be executed within the extension itself. Tasks requiring operating-system access can be forwarded to `nm_host.exe`. The attacker therefore gains a combined control layer covering both the user’s web sessions and the underlying endpoint.

That combination is what makes PEEP particularly interesting. Traditional malware often establishes host control first and then separately attempts to extract browser information. PEEP integrates both capabilities into one framework. The browser provides access to authenticated sessions, credentials, browsing activity and page content, while the native messaging component provides filesystem and command-execution capabilities. An attacker can therefore observe what the victim is doing online, manipulate web pages and simultaneously execute commands on the underlying operating system.

The web-page manipulation capability creates another important risk. SOCRadar reports that the PEEP extension can inject JavaScript into active pages and modify web content. Once malicious logic operates inside the user’s browser context, checking whether the URL in the address bar is legitimate becomes a weaker defense. The attacker can potentially alter what the user sees after the genuine website has already loaded. This is one reason endpoint compromise can undermine security assumptions that are perfectly reasonable before compromise. A legitimate domain and valid TLS certificate only prove that the browser communicated with the correct website; they do not prove that malware running inside the browser did not alter the resulting page locally.

PEEP also demonstrates why enterprise browser-management policies can become dual-use. Administrators legitimately use force-install policies to deploy security extensions, password managers and productivity tools without requiring individual user approval. An attacker with sufficient host privileges can abuse the same mechanism to force-install malicious extensions. Security teams should therefore monitor not only which extensions are present but how they were installed and whether extension policies changed unexpectedly.

Registry modifications relating to Chromium extension policy deserve particular monitoring. Unexpected additions to `ExtensionInstallForcelist`, `ExtensionSettings` or external extension registry locations should be treated as high-value security events when they occur outside approved software deployment workflows. Likewise, new Native Messaging Host registrations should receive scrutiny because they create a privileged bridge between browser extensions and local executables.

The use of signed Chrome and Edge processes also creates a detection challenge. PEEP’s browser logic executes inside software defenders already expect to see running on almost every endpoint. SOCRadar notes that this may help the toolkit evade detection approaches focused on unknown or unsigned executables. The lesson is not that browsers should be considered malicious, but that process reputation is increasingly insufficient as a standalone security signal. A trusted process can become the execution context for attacker-controlled logic.

This principle has appeared repeatedly in recent browser-focused post-exploitation research. In August, researchers disclosed a separate technique using the Chrome DevTools Protocol to access cookies and authenticated browser sessions from an already compromised Windows system. That technique similarly assumed prior code execution and did not rely on exploiting a Chrome vulnerability. Together, these developments suggest that attackers increasingly view active browser sessions as valuable post-compromise targets because modern browsers hold a concentrated collection of identities, credentials and access tokens.

For defenders, browser telemetry therefore needs to become a more visible part of endpoint monitoring. Organizations should maintain an inventory of installed extensions, enforce extension allowlists where feasible and alert when unapproved extensions appear. Browser-management policies should be centrally defined and periodically compared against endpoint configuration. A user suddenly acquiring a force-installed extension that does not exist in the organization’s approved catalog should not be treated as ordinary configuration drift.

Endpoint security teams should also monitor for suspicious creation of Native Messaging Host manifests, unfamiliar binaries such as `nm_host.exe`, modifications to Chrome or Edge Secure Preferences files and PowerShell activity interacting with browser profile directories. The combination of browser-profile tampering, extension installation and native messaging registration provides a much stronger indicator of malicious behavior than any one event independently.

Network detection may also be relatively effective against the currently reported PEEP implementation because the toolkit polls its C2 infrastructure every 30 seconds using plaintext HTTP. Repeated HTTP beaconing at highly regular intervals from browser-associated processes can provide a useful behavioral signal. However, defenders should assume that future variants can move to HTTPS, rotate infrastructure or modify beacon intervals once detection rules become widely available.

Organizations should therefore avoid treating the currently published IP addresses and domains as a complete PEEP detection strategy. Static indicators are useful for immediate hunting, but an attacker can change them far more quickly than defenders can update every endpoint. Behavioural indicators such as unauthorized browser-policy modification, abnormal extension persistence and native host execution are more durable.

The framework’s command infrastructure also suggests a reasonably mature post-exploitation design. PEEP includes endpoints for agent registration, heartbeat telemetry, extension updates, command results and automated data exfiltration. SOCRadar found a `/health` endpoint exposing internal status information showing 34 agents, 10 active sessions and 507 data records, although researchers caution that these figures cannot distinguish real victims from testing or laboratory systems. That caution is important because there is currently insufficient evidence to describe PEEP as a large-scale active campaign or assign a confirmed victim count.

Attribution is similarly uncertain. Researchers found Chinese-language artifacts in the source code, suggesting development by a Chinese-speaking operator, but no specific threat actor or campaign has been conclusively identified. References to “Authorized CTF” activity were also found in the tooling, and SOCRadar suggested this language may have been used when interacting with AI systems to reduce safety restrictions during development. That interpretation is plausible but should remain an assessment rather than being presented as established fact.

The AI-development angle is nevertheless interesting because PEEP appears to build on RedExt, an open-source browser-data analysis and red-team framework previously associated with GlassWorm-related activity. PEEP extends that base with dedicated installers, persistence logic, native-host execution, C2 heartbeat telemetry and an update mechanism. This illustrates another recurring security problem: legitimate open-source security and research tooling can substantially reduce development effort for attackers. The malicious innovation may lie less in creating every capability from scratch and more in integrating existing techniques into a reliable operational package.

From an incident-response perspective, discovering PEEP should therefore trigger investigation well beyond removal of the extension. Because PEEP requires prior compromise, finding it proves that another initial-access mechanism already succeeded. Security teams need to determine how the attacker first obtained administrative or code execution access, what activity occurred before PEEP was installed and whether additional persistence mechanisms remain.

All browser sessions on the compromised endpoint should also be considered potentially exposed. Security teams should revoke active sessions, invalidate relevant authentication tokens and rotate credentials where appropriate rather than merely changing the local browser profile. Cloud and SaaS audit logs should be reviewed for session use from unfamiliar devices, IP addresses or geographic locations after the suspected compromise period.

If the endpoint had access to privileged administrative portals, source-code repositories, financial applications or cloud consoles, those environments deserve particular scrutiny. PEEP’s browser surveillance capability means the attacker may know exactly which applications the victim uses and potentially possess session material for them.

The broader lesson is that endpoint compromise increasingly means browser compromise as well.

The browser has become one of the richest sources of post-exploitation value on a modern workstation. It contains active identity sessions, cookies, browsing history, clipboard content and direct access to much of the organization’s cloud environment.

PEEP takes that reality one stage further. Instead of simply stealing information from Chrome or Edge, it turns the browser into part of the attacker’s persistent command infrastructure. That changes the defensive question. It is no longer enough to ask whether `chrome.exe` or `msedge.exe` is legitimate software. Defenders increasingly need to ask whether the legitimate browser is still executing only legitimate instructions.

Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser. "Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks and user prompts by forging Chromium's own Secure Preferences

Source: PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution via The Hacker News — published 07 Sep 2026.