Hackers Can Use PEEP Chrome Extension to Steal Credentials and Execute Shell Commands

www.itsecuritynews.info • September 8, 2026

A newly identified Chromium-based post-exploitation toolkit named PEEP can turn Google Chrome and Microsoft Edge into persistent remote-access platforms, enabling attackers to steal browser data, hijack sessions, manage files and execute shell commands on compromised endpoints. Unlike a conventional initial-access malware strain, PEEP requires attackers to already possess administrative privileges or code-execution access on a […]

Read the original article:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PEEP Chrome Extension Turns Browsers Into Remote Access Tools Cybersecurity researchers have uncovered a sophisticated post-exploitation toolkit named PEEP, which masquerades as a 'Smart Bookmarks' Chrome extension. This malware requires prior administrative access to be installed, allowing it to bypass Web Store checks and inject itself directly into Chrome and Edge profiles. Once installed, PEEP can steal browser data, hijack sessions, and execute shell commands on compromised machines. It communicates with a command-and-control server every 30 seconds, exfiltrating sensitive data such as browsing history and session cookies. The toolkit is derived from the open-source RedExt framework and shows signs of being linked to a Chinese-speaking threat actor. PEEP's capabilities include remote command execution and file management, making it a significant threat to users of affected browsers. Current reports indicate that this malware is actively being exploited in the wild. 5 sources 76

Extracted Entities

Hackers Can Use PEEP Chrome Extension to Steal Credentials and Execute Shell Commands

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)