PEEP Malware: Chrome Extension Hijacks Browsers, Steals Data

PEEP post-exploit browser toolkit fakes bookmarks extension, bypasses Chrome checks, steals credentials and hijacks sessions

Researchers at SOCRadar uncovered a Chrome/Edge post-exploitation toolkit called PEEP that masquerades as a “Smart Bookmarks” extension.

The malware bypasses Web Store checks by forging Chromium’s Secure Preferences, deploying via sideloading and enterprise policies.

PEEP uses a native-messaging host to cross the browser sandbox, enabling remote command execution, credential theft, and session hijacking.

The toolkit, derived from open-source RedExt framework, appears linked to a Chinese-speaking threat actor based on code artifacts.

Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser. The malware requires prior administrative or code execution access, and its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks by forging Chromium’s own Secure Preferences integrity values.

Once installed, the “extension” agent polls its command-and-control server (“206.237.30[.]232” or “ xfjcc[.]fun “) every 30 seconds over plaintext HTTP for new commands. It exfiltrates browsing history, active-tab metadata, and session cookies while also functioning as a remote access toolkit that runs host commands and steals credentials.

PEEP builds on the open-source RedExt framework, previously used in GlassWorm attacks, but expands with dedicated installation routines, a native host bridge, heartbeat telemetry, and a broader command set. The activity remains unattributed, though Chinese-language artifacts in source code point to a Chinese-speaking threat actor.

The extension uses a native-messaging binary (“nm_host.exe”) to transform from a credential stealer into a remote-access tool. It invokes this binary when tasks require operating system access, while browser-based commands like screenshots or JavaScript injection run locally. SOCRadar noted: “Operating in the user context, the extension extracts browser artifacts and uses com.peep.lab/nm_host.exe to run shell commands, manage files, and discover processes and services.”

To ensure persistence, PEEP modifies the Secure Preferences file to auto-enable the extension on browser launch. It uses PowerShell scripts to enable Developer Mode, patch Secure Preferences, and force installation via registry keys and external extension manifests. A Python script “patch_secure_prefs_linux.py” suggests the threat actor is also targeting Linux environments.

The extension parses a configuration file to extract C2 information and activate automated data harvesting, while a companion content script is embedded across all active web pages. SOCRadar identified references to “Authorized CTF” use, possibly to lower AI tool safety guardrails for malware development. The “/health” endpoint shows 34 agent entries, 10 active sessions, and 507 data records, though test entries cannot be distinguished from actual infections.

✅ Follow BITNEWSBOT on Telegram , , , X.com , and Google News for instant updates.

Starcloud mining Bitcoin in space is a really crazy $2B idea

EIP-8141 Frames: Pay Gas in Tokens on Ethereum

Zcash ETF launch sparks rally to 2016 high

JSCeal Malware Steals Crypto via Compiled V8 Bytecode

Fomo overtakes Pump.fun in daily revenue on Solana