Cybersecurity researchers have revealed details about a sophisticated post-exploitation toolkit named PEEP that disguises itself as a bookmarks extension for Chromium-based browsers while secretly transforming Chrome and Edge into persistent backdoors. SOCRadar disclosed the malware in a recent report, describing how the toolkit requires prior administrative access to install but then bypasses Web Store security checks by forging Chromium's Secure Preferences integrity values. The extension polls its command-and-control server every 30 seconds over unencrypted HTTP, exfiltrating browsing history, active-tab metadata, and session cookies while executing host commands and manipulating web pages.
The malware masquerades as "Smart Bookmarks" and connects to C2 infrastructure at "206.237.30[.]232" or "xfjcc[.]fun," harvesting browser data while awaiting instructions through multiple API endpoints. PEEP builds on the RedExt framework, an open-source red teaming tool previously used in GlassWorm attacks, but adds dedicated installation routines, a native host bridge, heartbeat telemetry, an update channel, and expanded command capabilities. The extension invokes an auxiliary executable called "nm_host.exe" when tasks require operating system access, transforming the malware from a simple credential stealer into a full remote-access tool. The C2 panel's "/health" endpoint shows 34 agent entries, 10 active sessions, and 507 data records, though the report notes these figures can't distinguish actual infected hosts from test entries. Chinese-language artifacts in the source code point to a Chinese-speaking threat actor, but the activity remains officially unattributed.
According to SOCRadar, "requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks and user prompts by forging Chromium's own Secure Preferences integrity values." The report emphasizes that "operating in the user context, the extension extracts browser artifacts and uses com.peep.lab/nm_host.exe to run shell commands, manage files, and discover processes and services." PEEP maintains persistence through multiple techniques including sideloading, enterprise force-install policies, preference-integrity manipulation, and a ScriptCache fallback, according to the researchers. The malware deploys three PowerShell scripts to enable Developer Mode, patch the Secure Preferences file, and force-enable the extension, while a Python script with identical functionality suggests the threat actor is replicating behavior to target Linux environments as well.
The native messaging bridge represents the malware's most significant capability, allowing it to cross the browser sandbox and reach the underlying operating system. SOCRadar explains that "because its logic runs inside the signed browser process, it slips past detection of keys on new or unsigned binaries," effectively using the browser as an endpoint pivot for credential theft, session abuse, and command execution. The extension parses a configuration file to extract C2 information and activate automated data harvesting, while a companion content script embeds across all active web pages to enable JavaScript injection, screenshots, and clipboard access. The researchers identified references to "Authorized CTF" use in the code, raising the possibility that the threat actor may have used capture-the-flag framing to lower the safety guardrails of AI tools during malware development. Since PEEP lacks an initial access vector and functions as a post-compromise framework, defenders should focus on detecting administrative access breaches and monitoring for Secure Preferences file modifications, unusual browser extension sideloading, and native messaging host binaries that communicate with browser processes. Organizations relying on endpoint detection may miss this threat entirely, as the malware operates within the trusted browser process rather than launching suspicious executables that traditional security tools flag.