- Researchers at SOCRadar uncovered a Chrome/Edge post-exploitation toolkit called PEEP that masquerades as a “Smart Bookmarks” extension.
- The malware bypasses Web Store checks by forging Chromium’s Secure Preferences, deploying via sideloading and enterprise policies.
- PEEP uses a native-messaging host to cross the browser sandbox, enabling remote command execution, credential theft, and session hijacking.
- The toolkit, derived from open-source RedExt framework, appears linked to a Chinese-speaking threat actor based on code artifacts.
Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser. The malware requires prior administrative or code execution access, and its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks by forging Chromium’s own Secure Preferences integrity values.
Once installed, the “extension” agent polls its command-and-control server (“206.237.30[.]232” or “xfjcc[.]fun“) every 30 seconds over plaintext HTTP for new commands. It exfiltrates browsing history, active-tab metadata, and session cookies while also functioning as a remote access toolkit that runs host commands and steals credentials.
PEEP builds on the open-source RedExt framework, previously used in GlassWorm attacks, but expands with dedicated installation routines, a native host bridge, heartbeat telemetry, and a broader command set. The activity remains unattributed, though Chinese-language artifacts in source code point to a Chinese-speaking threat actor.
The extension uses a native-messaging binary (“nm_host.exe”) to transform from a credential stealer into a remote-access tool. It invokes this binary when tasks require operating system access, while browser-based commands like screenshots or JavaScript injection run locally. SOCRadar noted: “Operating in the user context, the extension extracts browser artifacts and uses com.peep.lab/nm_host.exe to run shell commands, manage files, and discover processes and services.”
To ensure persistence, PEEP modifies the Secure Preferences file to auto-enable the extension on browser launch. It uses PowerShell scripts to enable Developer Mode, patch Secure Preferences, and force installation via registry keys and external extension manifests. A Python script “patch_secure_prefs_linux.py” suggests the threat actor is also targeting Linux environments.
The extension parses a configuration file to extract C2 information and activate automated data harvesting, while a companion content script is embedded across all active web pages. SOCRadar identified references to “Authorized CTF” use, possibly to lower AI tool safety guardrails for malware development. The “/health” endpoint shows 34 agent entries, 10 active sessions, and 507 data records, though test entries cannot be distinguished from actual infections.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
