PEEP Malware Turns Chrome, Edge Into Backdoors

A newly disclosed malware toolkit can turn Google Chrome and Microsoft Edge into persistent backdoors, giving attackers a route from the browser into the underlying operating system.

Researchers at SOCRadar detailed PEEP, a Chromium-based post-exploitation framework that disguises itself as a “Smart Bookmarks” extension. PEEP is not an initial-access tool. Attackers must already be able to execute code on the machine, while some of its installation and persistence methods may require administrative privileges.

Once deployed, PEEP can steal browser data, hijack sessions, alter web pages, and use a native messaging component to execute commands on the host.

PEEP installs itself without normal browser prompts

PEEP differs from malicious extensions that depend on convincing a user to install something from an extension marketplace.

According to The Hacker News, its installer injects the extension directly into Chrome or Edge profiles and manipulates Chromium’s Secure Preferences integrity values to bypass Web Store checks and user prompts.

The extension presents itself as “Smart Bookmarks” and uses the ID ejkndncpkdcjcikfhiamcdehdoegilbj. It then contacts command-and-control infrastructure every 30 seconds over plaintext HTTP to receive instructions and return collected data.

Information Security Report said PEEP can exfiltrate browsing history, active-tab information, session cookies, and other browser data. Attackers can also use it to steal credentials and interfere with active sessions.

PEEP is based on RedExt, an open-source browser analysis and red-teaming framework. The new toolkit adds its own installation routines, heartbeat telemetry, update mechanism, native host bridge, and expanded command set.

A native messaging bridge gives PEEP access to the host

PEEP becomes more dangerous when its browser extension calls an auxiliary executable named nm_host.exe.

The component uses Chrome’s native messaging mechanism to move beyond browser-level activity. It can run shell commands, manage files, and discover processes and services on the compromised machine.

SOCRadar said PEEP abuses Chromium’s native messaging feature to communicate with a separately installed host executable, extending the attacker’s reach from the browser to the operating system without exploiting the browser sandbox.

Browser-based commands can also capture screenshots, access the clipboard, or inject JavaScript into web pages.

PEEP’s code runs within the trusted browser environment, which may make some of its activity less obvious to defenses focused primarily on unfamiliar or unsigned executables.

PEEP uses several methods to stay installed

Removing an unwanted extension may not be enough to clean up a PEEP infection.

Researchers found several persistence methods, including sideloading, enterprise force-install policies, Secure Preferences manipulation, and a ScriptCache fallback.

PowerShell scripts can enable Developer Mode, modify Secure Preferences, and force the extension back into the browser. Atlabyte reported that PEEP includes a Python script for making similar Secure Preferences changes on Linux. This indicates some cross-platform development, although it does not confirm that the toolkit’s full native-host functionality works on Linux.

PEEP’s command-and-control infrastructure also includes endpoints for registering infected systems, sending heartbeats, updating the extension, returning command results, and exfiltrating collected data.

SOCRadar said an exposed health endpoint displayed 34 registered agents, 10 active sessions, and 507 data records. Researchers could not determine whether those entries represented genuine victims, testing systems, or other activity, so the figures are not a confirmed infection count.

Attribution remains similarly uncertain. Chinese-language artifacts were found in the source code, but the available evidence does not establish who developed or deployed PEEP.

What security teams should check after a compromise

PEEP gives incident responders another reason to examine the browser after an attacker has already gained control of an endpoint.

Simply finding and removing the malware that provided initial access may leave another persistence mechanism behind. Chrome and Edge settings can become part of the attacker’s foothold, particularly when enterprise policies or native messaging are abused.

After a suspected compromise, defenders should consider checking:

• Installed and forced extensions: Look for unfamiliar extensions, unexpected sideloading, and changes to ExtensionInstallForcelist or related enterprise policies.
• Chromium preferences and native messaging: Review Secure Preferences changes, registered native messaging hosts, and unexpected executables such as nm_host.exe.
• Browser-originated activity: Investigate unusual child processes, shell execution, outbound HTTP connections, and browser activity that does not match normal user behavior.

CISO AI also recommends restricting administrative access because PEEP needs elevated access or prior code execution before it can be installed.

PEEP does not replace an attacker’s initial access method. Its value comes afterward, when a compromised browser can provide continued access to sessions, credentials, and the host itself. For defenders, a browser that appears to be functioning normally may still deserve scrutiny after the original intrusion has been contained.

Also read: For another example of malware continuing to spread after infrastructure disruption, read how WeedHack is still being distributed through fake Minecraft sites, SEO poisoning, and trusted hosting platforms.