Back Ground.News

Malicious Chrome Extension Can Steal Login Sessions and Turn PCs Into Remote Backdoors

Ground.News • September 7, 2026

Researchers at SOCRadar uncovered a Chrome/Edge post-exploitation toolkit called PEEP that masquerades as a “Smart Bookmarks” extension. The malware bypasses […]

PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution

Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser. "Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks and user prompts by forging Chromium's own Secure Preferences integrity values," SOCRadar

Malicious Chrome Extension Can Steal Login Sessions and Turn PCs Into Remote Backdoors

PEEP, a malicious Chrome extension posing as Smart Bookmarks, can steal active login sessions and turn an already compromised Windows computer into a remote backdoor. The finding shows how a browser add-on can become far more dangerous than a simple data thief when it gains a path to the operating system. The toolkit does not […]

Hackers Can Use PEEP Chrome Extension to Steal Credentials and Execute Shell Commands

There is no tracked Bias information for the sources covering this story.

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PEEP Chrome Extension Turns Browsers Into Remote Access Tools Cybersecurity researchers have uncovered a sophisticated post-exploitation toolkit named PEEP, which masquerades as a 'Smart Bookmarks' Chrome extension. This malware requires prior administrative access to be installed, allowing it to bypass Web Store checks and inject itself directly into Chrome and Edge profiles. Once installed, PEEP can steal browser data, hijack sessions, and execute shell commands on compromised machines. It communicates with a command-and-control server every 30 seconds, exfiltrating sensitive data such as browsing history and session cookies. The toolkit is derived from the open-source RedExt framework and shows signs of being linked to a Chinese-speaking threat actor. PEEP's capabilities include remote command execution and file management, making it a significant threat to users of affected browsers. Current reports indicate that this malware is actively being exploited in the wild. 5 sources 76

Extracted Entities

Malicious Chrome Extension Can Steal Login Sessions and Turn PCs Into Remote Backdoors

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (3)

Tools (1)