{"id":80194,"date":"2026-09-07T16:38:45","date_gmt":"2026-09-07T20:38:45","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=80194"},"modified":"2026-09-07T16:38:45","modified_gmt":"2026-09-07T20:38:45","slug":"peep-chrome-edge-backdoor-toolkit-malware-cybersecurity-threat-detection-evasion-post-compromise-remote-access-data-exfiltration-socradar-research-browser-extension-backdoor-native-messaging-hosting-c","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/peep-chrome-edge-backdoor-toolkit-malware-cybersecurity-threat-detection-evasion-post-compromise-remote-access-data-exfiltration-socradar-research-browser-extension-backdoor-native-messaging-hosting-c\/","title":{"rendered":"PEEP Turns Chrome and Edge into Post-Compromise Backdoors"},"content":{"rendered":"<p>A newly identified post-exploitation toolkit is transforming <a href=\"https:\/\/www.google.com\/\" target=\"_blank\" rel=\"noopener noreferrer\" data-iacss-external=\"1\">Google<\/a> Chrome and <a href=\"https:\/\/www.microsoft.com\/\" target=\"_blank\" rel=\"noopener noreferrer\" data-iacss-external=\"1\">Microsoft<\/a> Edge browsers into fully operational backdoors, granting attackers persistent remote access to compromised systems. Dubbed PEEP by researchers at SOCRadar, this sophisticated Chromium-based malware masquerades as a harmless bookmark extension while secretly exfiltrating data, executing system commands, and manipulating web content. What makes PEEP particularly dangerous is that it operates entirely within the browser&#8217;s trusted process environment, evading detection mechanisms that monitor for unknown or unsigned binaries.<\/p>\n<h2>What Is PEEP and How Does It Turn Browsers into Backdoors?<\/h2>\n<p>PEEP is a post-compromise framework that requires an attacker to have already gained administrative or code execution access to a target system. Once deployed, it injects a malicious browser extension directly into Chrome or Edge user profiles, bypassing the official Chrome Web Store and all user prompts. The extension masquerades under the name &#8220;Smart Bookmarks&#8221; with the identifier <strong>ejkndncpkdcjcikfhiamcdehdoegilbj<\/strong>. It polls its command-and-control (C2) server every 30 seconds over plaintext HTTP to receive new instructions, while simultaneously exfiltrating browsing history, active-tab metadata, and session cookies. Through a native-messaging bridge, PEEP extends its reach beyond browser telemetry to host-level command execution and file management, effectively converting the browser into a persistent remote access tool.<\/p>\n<h2>Technical Deep Dive: The Extension, Native Messaging, and C2 Infrastructure<\/h2>\n<h3>The Browser Extension Core<\/h3>\n<p>The PEEP extension is the main agent responsible for the beacon loop. It regularly contacts the endpoint <strong>\/api\/commands<\/strong> on its C2 server to retrieve new tasks. The known C2 servers are <strong>206.237.30[.]232<\/strong> and <strong>xfjcc[.]fun<\/strong>. Beyond command retrieval, the extension harvests extensive browser data and sends results back via several API endpoints:<\/p>\n<ul>\n<li><strong>\/api\/register<\/strong> \u2013 registers the infection with the C2 panel.<\/li>\n<li><strong>\/api\/agents\/[id]\/heartbeat<\/strong> \u2013 sends browser User-Agent string, operating system details, and time zone.<\/li>\n<li><strong>\/api\/agents\/[id]\/task_result<\/strong> \u2013 posts the results of executed commands.<\/li>\n<li><strong>\/api\/exfil<\/strong> \u2013 pushes auto-collected data including cookies, recent history, open tabs, active URL, public IP address, locale, and time zone.<\/li>\n<li><strong>\/api\/extension_update\/<\/strong> and <strong>\/api\/extension_crx\/<\/strong> \u2013 allow the extension to update itself.<\/li>\n<li><strong>\/health<\/strong> \u2013 serves internal system status without requiring login credentials.<\/li>\n<li><strong>\/login<\/strong> \u2013 provides a login interface for the C2 panel at port 5001.<\/li>\n<\/ul>\n<p>The extension also embeds a companion content script (<strong>content.js<\/strong>) across all active web pages, enabling real-time page modification and clipboard access.<\/p>\n<h3>The Native-Messaging Bridge<\/h3>\n<p>When a task requires operating system access \u2014 such as running shell commands, managing files, or discovering processes and services \u2014 the extension invokes an auxiliary executable named <strong>nm_host.exe<\/strong>. This binary acts as a native-messaging host, a legitimate Chrome API that allows extensions to communicate with native applications. By using this bridge, PEEP transcends the browser sandbox and operates with the privileges of the user context. Browser-based commands like screenshots, clipboard access, or JavaScript injection are executed locally within the extension itself.<\/p>\n<h3>Derivative of the RedExt Framework<\/h3>\n<p>PEEP is built on the foundations of <strong>RedExt<\/strong>, an open-source browser data analysis and red teaming framework that was previously used in <strong>GlassWorm<\/strong> attacks. However, PEEP expands significantly on RedExt by adding dedicated installation routines, a native host bridge, heartbeat telemetry, an update channel, and a broader command set. This evolution transforms a red team tool into a full-fledged malware platform.<\/p>\n<h2>Persistence and Installation: Bypassing Web Store Security<\/h2>\n<h3>Tampering with Chrome&#8217;s Secure Preferences<\/h3>\n<p>One of PEEP&#8217;s most notable technical achievements is its ability to modify the browser&#8217;s <strong>Secure Preferences<\/strong> file. This file is cryptographically signed by Chromium to prevent tampering. The malware forges these integrity values to ensure the malicious extension is auto-enabled upon every browser launch. This is achieved through a PowerShell script called <strong>patch_secure_prefs.ps1<\/strong>, which directly patches the preferences file without triggering integrity warnings.<\/p>\n<h3>Sideloading and Enterprise Policies<\/h3>\n<p>Since the extension <a href=\"https:\/\/overcentral.com\/en\/ai-search-moves-cognitive-load-does-not-remove-it\/\" title=\"AI Search Moves Cognitive Load, Does Not Remove It\" data-iacss-internal=\"1\">does not<\/a> appear in any official store, attackers rely on alternative installation methods:<\/p>\n<ul>\n<li><strong>install_silent.ps1<\/strong> \u2013 enables Developer Mode to sideload arbitrary extensions.<\/li>\n<li><strong>force_enable.ps1<\/strong> \u2013 removes the extension from the Preferences <em>external_uninstalls<\/em> list, places the CRX file at <strong>%LOCALAPPDATA%\\PEEP\\crx<\/strong>, re-registers via the HKCU Extensions key and an External Extensions JSON manifest, and then restarts the browser.<\/li>\n<\/ul>\n<p>Additionally, the malware can leverage the <strong>ExtensionInstallForcelist<\/strong> or <strong>ExtensionSettings<\/strong> group policies, and uses a <strong>ScriptCache<\/strong> fallback mechanism to ensure persistence even if the extension is manually removed.<\/p>\n<h3>Linux Targeting<\/h3>\n<p>A Python script named <strong>patch_secure_prefs_linux.py<\/strong> was also discovered, indicating the threat actor is replicating the same behavior for Linux environments. This cross-platform ambition increases the potential scope of future infections.<\/p>\n<h2>Current Threat Landscape: Limited but Active Infections<\/h2>\n<p>As of the time of analysis, the <strong>\/health<\/strong> endpoint showed 34 agent entries, 10 active sessions, and 507 data records. It is impossible to distinguish real infected hosts from test entries or verified deployments, but the numbers suggest a contained but active operation. The threat actor remains unclaimed, though the presence of Chinese-language artifacts in the source code points to a Chinese-speaking group. Researchers also noted references to &#8220;Authorized CTF&#8221; use, possibly a deliberate framing to bypass <a href=\"https:\/\/overcentral.com\/en\/nemo-guardrails-enterprise-ai-safety-77434\/\" title=\"NeMo Guardrails for Enterprise AI Safety\" data-iacss-internal=\"1\">AI safety<\/a> guardrails during malware development.<\/p>\n<h2>Strategic Implications: The Browser as an Endpoint Pivot<\/h2>\n<p>PEEP exemplifies a growing trend in post-compromise tooling: using trusted, signed browser processes as a cover for malicious activity. Because the extension&#8217;s logic runs inside the browser \u2014 a signed and frequently whitelisted executable \u2014 it slips past many endpoint detection and response systems that focus on new or unsigned binaries. The browser becomes an endpoint pivot for <a href=\"https:\/\/overcentral.com\/en\/langflow-and-rails-exploits-trigger-wave-of-ai-credential-theft\/\" title=\"Langflow and Rails Exploits Trigger Wave of AI Credential Theft\" data-iacss-internal=\"1\">credential theft<\/a>, session hijacking, and command execution. As defenses improve against traditional malware, threat actors are increasingly turning to living-off-the-land techniques that abuse legitimate platform features. Organizations must therefore extend their security monitoring to include browser extension behavior, native-messaging hosts, and integrity checks on user profile preferences. The sophistication of PEEP underscores that even a fully patched browser can become a dangerous weapon when the attacker already controls the machine.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A newly identified post-exploitation toolkit is transforming Google Chrome and Microsoft Edge browsers into fully operational backdoors, granting attackers persistent remote access to compromised systems. Dubbed PEEP by researchers at SOCRadar, this sophisticated Chromium-based malware masquerades as a harmless bookmark extension while secretly exfiltrating data, executing system commands, and manipulating web content. What makes PEEP [&hellip;]<\/p>\n","protected":false},"author":7,"featured_media":83011,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/80194.png","fifu_image_alt":"PEEP Turns Chrome and Edge into Post-Compromise Backdoors","footnotes":""},"categories":[40668],"tags":[],"class_list":["post-80194","post","type-post","status-publish","format-standard","has-post-thumbnail","category-security"],"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/80194.png","fifu_image_alt":"PEEP Turns Chrome and Edge into Post-Compromise Backdoors","_links":{"self":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/80194","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/comments?post=80194"}],"version-history":[{"count":0,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/80194\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media\/83011"}],"wp:attachment":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media?parent=80194"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/categories?post=80194"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/tags?post=80194"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}