Ethical Hacking News
Security researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for Chrome and Edge browsers, establishing a persistent post-compromise backdoor for host command execution and data exfiltration.
The PEEP toolkit is a post-compromise framework that lacks an initial access vector, requiring operators to breach a machine through other means to deploy the malware. The toolkit has the potential to establish a persistent post-compromise backdoor for host command execution, file management, and exfiltration of sensitive data. PEEP masquerades as a legitimate bookmarks extension and uses sideloading tricks, extension install policies, and preference-integrity manipulation to maintain persistence. The toolkit uses PowerShell scripts to enable Developer Mode and patch the Secure Preferences file, allowing it to auto-enable itself upon launching the browser. PEEP can target both Windows and Linux environments, using a Python script to replicate the behavior for Linux systems. The threat actor is believed to be Chinese-speaking, but the activity remains unattributed.
The cybersecurity landscape has witnessed numerous threats in recent times, with new vulnerabilities and attack vectors emerging at an alarming rate. One such threat that has garnered significant attention in the recent past is the PEEP (Post-Exploitation Exploitation Payload) toolkit, which has been found to masquerade as a bookmarks extension for the popular web browsers, Chrome and Edge. According to cybersecurity researchers, PEEP has the potential to establish a persistent post-compromise backdoor that can be used for host command execution, file management, and exfiltration of sensitive data.
The PEEP toolkit is built on the foundations of an open-source, browser data analysis and red teaming framework called RedExt, which has also been used in prior GlassWorm attacks. However, PEEP expands on the toolkit with dedicated installation routines, a native host bridge, heartbeat telemetry, an update channel, and a broader command set, making it a derivative of RedExt. This expansion has enabled PEEP to become a more sophisticated and versatile tool, capable of establishing a persistent backdoor that can be used for a variety of malicious purposes.
The PEEP toolkit is designed to masquerade as a legitimate bookmarks extension, with a unique identifier of "Smart Bookmarks" (ID: ejkndncpkdcjcikfhiamcdehdoegilbj). This extension is the main agent responsible for executing the beacon loop by polling "/api/commands," harvesting browser data, receiving additional tasking, and sending the results back. The browser add-on also invokes an auxiliary executable ("nm_host.exe") when said task requires operating system access, while browser-based commands (e.g., screenshots, clipboard, or JavaScript injection) are run locally.
One of the key features of PEEP is its ability to modify the Secure Preferences file to ensure that the extension is auto-enabled upon launching the browser. Given that the extension is not available on the Chrome Web Store and other official extension marketplaces, it also leverages the ExtensionInstallForcelist or ExtensionSettings policies and sideloading tricks for delivery. To aid in this tampering, the malware makes use of two PowerShell scripts - install_silent.ps1, which enables Developer Mode to sideload arbitrary extensions, and patch_secure_prefs.ps1, which patches the Secure Preferences file.
The PEEP toolkit also uses a Python script "patch_secure_prefs_linux.py" to replicate the behavior to also target Linux environments. Once initialized, the extension parses a configuration file to extract C2 information and activate automated data harvesting, while a companion content script ("content.js") is embedded across all active web pages.
SOCRadar has identified a number of references to "Authorized CTF" use, raising the possibility that the threat actor may have used the framing to lower the safety guardrails of AI tools and assist in malware development. There are currently no signs as to who is being targeted, but the "/health" endpoint shows 34 agent entries, 10 active sessions, and 507 data records.
The PEEP toolkit has been described as a post-compromise framework, meaning it lacks an initial access vector itself, requiring the operator to breach a machine through some other means and deploy the malware. The activity remains unattributed, although the presence of Chinese-language artifacts in the source code points to a Chinese-speaking threat actor.
The use of the Native Messaging Host binary transforms the malware from a basic credential stealer to a remote-access tool. Operating in the user context, the extension extracts browser artifacts and uses com.peep.lab/nm_host.exe to run shell commands, manage files, and discover processes and services. Bypassing Web Store checks, PEEP maintains persistence via sideloading, enterprise force-install policies, preference-integrity manipulation, and a ScriptCache fallback.
In conclusion, the PEEP toolkit represents a significant threat to the security of Chrome and Edge browsers, as it can establish a persistent post-compromise backdoor that can be used for host command execution, file management, and exfiltration of sensitive data. The toolkit's ability to modify the Secure Preferences file and leverage sideloading tricks for delivery makes it a sophisticated and versatile tool, capable of evading detection and maintaining persistence in the compromised system.
Related Information:
https://www.ethicalhackingnews.com/articles/PEEP-Exploits-Chrome-and-Edge-Browsers-to-Establish-Persistent-Post-Compromise-Backdoors-ehn.shtml
https://thehackernews.com/2026/09/peep-turns-chrome-and-edge-into-post.html
Published: Mon Sep 7 16:30:04 2026 by llama3.2 3B Q4_K_M
