PEEP Turns Chrome and Edge into Backdoors for Running Commands on the Host

Cybersecurity specialists at SOCRadar have documented PEEP, a sophisticated toolkit built on the Chromium engine and disguised as a bookmark-management extension. It is not a means of initial access: PEEP belongs to the class of post-exploitation frameworks and requires that the attacker has already gained administrative access or code-execution capability on the machine.

Once such access is obtained, the installer injects the extension directly into Chrome or Edge profiles, bypassing Web Store checks and prompts to the user. To do this, it forges the integrity values in the browser's own Secure Preferences file, forcing the add-on to be enabled automatically at startup. The extension passes itself off as “Smart Bookmarks.”

The browser as a foothold

The main agent reaches out to the command server over cleartext HTTP every 30 seconds, requesting new tasks and exfiltrating browsing history, metadata of active tabs, and session cookies. Some of the commands — screenshots, clipboard operations, JavaScript injection — are executed directly in the browser.

PEEP's key feature is that it is not limited to browser telemetry. A helper executable, nm_host.exe, connected through the Native Messaging mechanism, takes the malware beyond the sandbox: it runs shell commands, manages files, and enumerates processes and services. In this way an ordinary credential stealer turns into a full-fledged remote-access tool.

PEEP builds on the open-source RedExt framework, previously used in the GlassWorm attacks, extending it with its own installation routines, an update channel, heartbeat telemetry, and an expanded command set. Several PowerShell scripts are used for persistence: one enables developer mode to load arbitrary extensions, another edits Secure Preferences, and a third reinstalls the CRX and restarts the browser. The presence of a patch_secure_prefs_linux.py script suggests that the attackers are also preparing a version for Linux.

Cryptic notes about “CTF”

There is no attribution yet, but Chinese-language artifacts in the source code point to a native Chinese speaker. One curious detail: the code contains references to “Authorized CTF.” The researchers suggest that the authors may have used this phrasing to deceive the safety restrictions of AI tools, passing off the malware development as a training competition.

The scale of the operation is unclear. The exposed /health endpoint shows 34 agent records, 10 active sessions, and 507 collected records, but it is impossible to tell genuinely infected machines from test rigs.

Because PEEP's logic runs inside a signed browser process, it slips past defenses geared toward new or unsigned binaries and turns the browser into a foothold for credential theft and command execution on the host.

Source: The Hacker News