PEEP Toolkit Turns Chrome and Edge Into Post-Compromise Backdoors

A newly disclosed post-exploitation toolkit called PEEP is turning Google Chrome and Microsoft Edge into persistent backdoors for host-level command execution. Cybersecurity researchers at SOCRadar disclosed the framework this week, describing it as a Chromium-based toolkit that masquerades as a bookmarks extension. Also, it deploys a native-messaging bridge to extend browser telemetry into full remote access operations.

What Happened: PEEP Toolkit Turns Chrome and Edge Into Persistent Backdoors

SOCRadar identified PEEP as a post-compromise toolkit that requires prior administrative or code-execution access on a target machine. Once inside, the attacker injects a malicious extension directly into Chrome or Edge profiles. Consequently, the implant bypasses Web Store checks and user prompts by forging Chromium’s own Secure Preferences integrity values.

After installation, a native-messaging tool extends the implant beyond browser telemetry. It enables host-level command execution, file management, and session credential theft. Moreover, the extension polls its command-and-control server every 30 seconds over plaintext HTTP. While exfiltrating browsing history, active-tab metadata, and session cookies, it also functions as a remote access toolkit.

PEEP is built on the foundations of RedExt, an open-source browser data analysis and red-teaming framework. However, it expands RedExt with dedicated installation routines, a native host bridge, heartbeat telemetry, an update channel, and a broader command set. The presence of Chinese-language artifacts in the source code points to a Chinese-speaking threat actor. That said, SOCRadar did not attribute the activity to a specific group.

Technical Details of the PEEP Toolkit

The PEEP extension masquerades as Smart Bookmarks using the ID ejkndncpkdcjcikfhiamcdehdoegilbj. Furthermore, the main agent executes a beacon loop by polling /api/commands, harvesting browser data, receiving additional tasking, and sending results back to the C2 server.

The extension invokes an auxiliary executable called nm_host.exe when a task requires operating-system access. In contrast, browser-based commands such as screenshots, clipboard access, and JavaScript injection run locally. Therefore, the native-messaging host binary transforms the malware from a basic credential stealer into a full remote-access tool.

SOCRadar also identified several C2 endpoints used by the framework:

• /api/register — registers new infections
• /api/agents/<id>/heartbeat — sends User-Agent, operating system, and time zone
• /api/extension_update/ and /api/extension_crx/ — updates the extension itself
• /api/agents/<id>/task_result — posts command execution results
• /api/exfil — auto-collects cookies, history, open tabs, active URL, public IP, locale, and time zone
• /health — serves internal system status without requiring login credentials
• /login — serves a login interface for the C2 panel at port 5001

The malware also leverages multiple persistence mechanisms:

• Developer Mode sideloading — install_silent.ps1 enables arbitrary extension loading
• Secure Preferences patching — patch_secure_prefs.ps1 forges Chromium integrity values
• Extension re-registration — force_enable.ps1 removes uninstall flags and re-registers via registry keys
• ScriptCache fallback — maintains persistence even if other mechanisms are removed

Additionally, a Python script named patch_secure_prefs_linux.py indicates the threat actor is replicating the same behavior for Linux environments.

Business and Operational Impact

PEEP poses a significant risk to enterprise environments because it operates within the browser, which is typically trusted in most security policies. Consequently, traditional endpoint detection may not flag legitimate browser processes performing malicious actions. The impact includes:

• Credential theft — session cookies and browser-stored passwords are harvested in real time
• Session hijacking — active tabs and authenticated sessions can be taken over remotely
• Host compromise — native-messaging bridge enables arbitrary command execution and file management
• Data exfiltration — browsing history, clipboard contents, and screenshots are captured automatically
• Web-page manipulation — attackers can alter page content for phishing or financial fraud

SOCRadar observed that the /health endpoint showed 34 agent entries, 10 active sessions, and 507 data records. However, the researchers noted there is no reliable way to differentiate actual infected hosts from test entries or verified deployments.

Mitigation and Recommendations

Immediate Actions for Defenders

1. Audit browser extensions across all endpoints and remove any extension with the ID ejkndncpkdcjcikfhiamcdehdoegilbj
2. Review Chrome Secure Preferences files for tampered integrity values, especially on managed devices
3. Monitor for native-messaging hosts registered under com.peep.lab or unknown publishers
4. Inspect ExtensionInstallForcelist policies and ExtensionSettings GPO entries for unauthorized entries
5. Block C2 infrastructure at the network layer for IPs 206.237.30[.]232 and domain xfjcc[.]fun

Detection Opportunities

Security teams should hunt for the following indicators of compromise:

• Unknown PowerShell processes modifying Chrome Secure Preferences files
• Browser traffic to /api/commands, /api/exfil, or /api/extension_update endpoints
• Extension activity from IDs not present in the Chrome Web Store
• Registry modifications under HKCU\Software\Google\Chrome\Extensions for unexpected extension IDs
• Files named patch_secure_prefs.ps1, install_silent.ps1, or force_enable.ps1 on disk

Hardening Guidance

Organizations should restrict browser extension installations to approved publishers via policy. Additionally, enabling extension installation logging and monitoring for developer-mode activation will help surface unauthorized sideloading. Finally, network segmentation should prevent unexpected outbound HTTP beacon traffic from workstations.

Bottom line: PEEP demonstrates that browser post-exploitation toolkits are advancing rapidly. Because the implant leverages legitimate browser APIs and native messaging, it blends into normal user activity. Therefore, organizations must audit extensions aggressively and monitor for anomalous browser behavior.

Incident Summary

Threat Name:	PEEP (Post-Exploitation Extension Platform)
Also Known As:	Smart Bookmarks (masquerade name)
Attribution:	Unattributed; Chinese-language artifacts present
Target Platforms:	Google Chrome, Microsoft Edge, Chromium-based browsers
Initial Access:	Requires prior admin or code-execution access (post-compromise)
Disclosure Date:	September 7, 2026
Source:	SOCRadar technical analysis

References

1. SOCRadar, “PEEP Browser RAT: Chrome Extension Post-Exploitation Toolkit,” September 7, 2026, https://socradar.io/blog/peep-browser-rat-chrome-extension/, accessed September 8, 2026.
2. The Hacker News, “PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution,” September 7, 2026, https://thehackernews.com/2026/09/peep-turns-chrome-and-edge-into-post.html, accessed September 8, 2026.
3. BleepingComputer, “Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit,” September 8, 2026, https://www.bleepingcomputer.com/news/security/hackers-breach-f5-big-ip-apm-devices-to-deploy-linux-rootkit/, accessed September 8, 2026.
4. Google Threat Intelligence Group, “From Prompting to Autonomy: The Evolution of Adversarial AI,” September 2026, https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai, accessed September 8, 2026.