Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit dubbed **PEEP**, which masquerades as a bookmarks extension for web browsers. ### Bypassing Browser Defenses According to **SOCRadar**, **PEEP** requires prior administrative or code execution access. Its installer injects the extension directly into **Chrome** and **Edge** profiles, bypassing Web Store checks and user prompts by forging Chromium's own Secure Preferences integrity values. A native-messaging tool then extends its capabilities beyond browser telemetry to host-level command execution and file management. ### Remote Access and Data Exfiltration Once installed, the **PEEP** "extension" agent polls its command-and-control (C2) server (identified as `206.237.30[.]232` or `xfjcc[.]fun`) every 30 seconds over plaintext HTTP for new commands. Concurrently, it exfiltrates browsing history, active-tab metadata, and session cookies. The toolkit functions as a remote access and browser monitoring tool, capable of running host commands, stealing credentials, hijacking sessions, and altering web pages. ### Evolution from RedExt **PEEP** is built upon the foundations of **RedExt**, an open-source browser data analysis and red teaming framework previously used in **GlassWorm** attacks. However, **PEEP** expands on **RedExt** with dedicated installation routines, a native host bridge, heartbeat telemetry, an update channel, and a broader command set, making it a more advanced derivative. ### Post-Compromise Framework Described as a post-compromise framework, **PEEP** lacks an initial access vector. This means the operator must first breach a machine through other means before deploying the malware. While the activity remains unattributed, the presence of Chinese-language artifacts in the source code suggests a Chinese-speaking threat actor. The extension masquerades as "Smart Bookmarks" (ID: `ejkndncpkdcjcikfhiamcdehdoegilbj`). It acts as the primary agent, responsible for executing the beacon loop, polling `/api/commands`, harvesting browser data, receiving additional tasks, and sending results back. When a task requires operating system access, the browser add-on invokes an auxiliary executable, `nm_host.exe`. Browser-based commands (e.g., screenshots, clipboard, or JavaScript injection) are executed locally. The utilization of the **Native Messaging Host binary** transforms the malware from a basic credential stealer into a full-fledged remote-access tool. ### Persistence and Evasion **SOCRadar** elaborates that **PEEP** operates in the user context, extracting browser artifacts and leveraging `com.peep.lab/nm_host.exe` to run shell commands, manage files, and discover processes and services. It maintains persistence by bypassing Web Store checks through sideloading, enterprise force-install policies, preference-integrity manipulation, and a **ScriptCache** fallback.  The extension uses several endpoints for its operations: * `/api/register` to register the infection. * `/api/agents/<id>/heartbeat` to send browser **User-Agent** string, operating system, and time zone details. * `/api/extension_update/` and `/api/extension_crx/` to update the extension itself. * `/api/agents/<id>/task_result` to post the results of command execution. * `/api/exfil` to post automatically collected data, including cookies, recent history, open tabs, active URL, public IP address, locale, and time zone. * `/health` to serve internal system status without requiring login credentials. * `/login` to serve a login interface for the C2 panel at port 5001. A key aspect of **PEEP** is its ability to modify the Secure Preferences file, ensuring the extension is auto-enabled upon browser launch. As it's not available on official marketplaces, it leverages **ExtensionInstallForcelist** or **ExtensionSettings** policies and sideloading techniques for delivery. ### Installation Mechanisms To facilitate this tampering, the malware employs two **PowerShell** scripts: * `install_silent.ps1`, which enables **Developer Mode** to sideload arbitrary extensions. * `patch_secure_prefs.ps1`, which patches the Secure Preferences file. * `force_enable.ps1`, which removes the extension from Preferences’s `external_uninstalls`, places the CRX at `%LOCALAPPDATA%\PEEP\crx`, re-registers via the **HKCU Extensions** key and an **External Extensions JSON** manifest, and restarts the browser. The existence of a Python script, `patch_secure_prefs_linux.py`, suggests the threat actor is also targeting **Linux** environments. Upon initialization, the extension parses a configuration file for C2 information and activates automated data harvesting. A companion content script, `content.js`, is embedded across all active web pages. **SOCRadar** noted references to "Authorized CTF" use, raising concerns that the threat actor may have used this framing to lower the safety guardrails of AI tools for malware development. While specific targets are unknown, the `/health` endpoint showed 34 agent entries, 10 active sessions, and 507 data records, though it's unclear how many of these are actual infections versus test entries. "**PEEP** builds on existing host compromises, using a native-messaging bridge to convert **Chrome**/**Edge** into a persistent backdoor that crosses the browser sandbox to reach the OS," **SOCRadar** concluded. "Because its logic runs inside the signed browser process, it slips past detection of keys on new or unsigned binaries. Consequently, the browser acts as an endpoint pivot for credential theft, session abuse, and command execution."