PEEP Malware: Fake Chrome Extension Turns Browsers Into Full Remote-Access Backdoors
Kiran 
A newly documented post-exploitation toolkit called PEEP is redefining what a malicious browser extension can do: not just steal cookies, but hand attackers a direct line into the operating system itself.
Researchers at SOCRadar’s Threat Research Unit (STRU) uncovered the tool disguised as an innocuous “Smart Bookmarks” extension for Chrome and Edge, revealing a sophisticated bridge between browser compromise and full host control.
PEEP doesn’t rely on tricking users into installing it from the Chrome Web Store. Instead, it requires prior administrative or code-execution access to a machine, then forges the integrity checks Chromium uses to validate installed extensions, specifically the HMAC-based “Secure Preferences” values, so the browser silently trusts and auto-enables it on launch.
PEEP Malware: Fake Chrome Extension Turns Browsers
Once active, a native-messaging component called nm_host.exe extends the extension’s reach far beyond the browser sandbox, enabling shell command execution, file manipulation, and process enumeration on the underlying Windows host.
Built on the open-source RedExt framework, PEEP retains its predecessor’s core registration and polling logic while adding a dedicated installer, update channel, and a vastly expanded command set, evolving what began as research code into what researchers describe as an “enterprise-grade post-exploitation framework.”
What makes PEEP particularly resilient is its layered persistence strategy. Beyond the forged preference integrity values, it can piggyback on enterprise force-install group policies, sideload externally when other routes are blocked, and fall back on a technique dubbed “Ghost Anchor Persistence.”
This last trick exploits the way Chrome caches compiled Manifest V3 service workers by URL rather than by content, meaning that even after malicious source files are replaced with clean ones, Chrome can still reload previously cached compiled malicious code from its ScriptCache.
Despite its technical sophistication, PEEP’s operators left glaring gaps. The command-and-control server, hardcoded to IP 206.237.30[.]232 in Hong Kong-based AS55933, communicates over unencrypted HTTP with beacons every 30 seconds.
An open directory on port 5002 exposed 38 iterative build packages, source code, QA logs, and, critically, the private signing key for the extension’s primary identity, meaning anyone with the leaked corpus could sign malicious updates for it.
Traditional Chinese-language QA documentation, including a file testing the toolkit against Chrome 150 on Windows, points to a Chinese-speaking developer or operator, though SOCRadar stops short of firm nation-state attribution.
A login panel bearing an “AI” brand and bilingual “authorized CTF” disclaimers suggests the developer may have leaned on AI coding assistants while attempting to dodge safety guardrails, though no direct evidence of AI prompts was recovered.
Mitigation
SOCRadar’s guidance centers on treating the browser as a first-class endpoint, not a sandboxed afterthought:
- Block egress traffic to 206.237.30[.]232 and monitor ports 5001–5002.
- Force-uninstall extension IDs ejkndncpkdcjcikfhiamcdehdoegilbj and bibjjhidpdmfcbkodddndmoejcloobdh, and purge the com.peep.lab native-messaging registry entries.
- Enforce strict extension allow-listing via GPO/MDM and disable developer mode enterprise-wide.
- Deploy EDR rules to flag PowerShell or non-browser processes that write to Secure Preferences files.
- Adopt phishing-resistant MFA and app-bound encryption to blunt session-cookie theft even if an agent slips through.
PEEP’s biggest lesson may be structural: with browsers now running mission-critical work, a compromised extension paired with a native messaging bridge can be just as dangerous as a traditional endpoint RAT, and current defenses, built around Web Store vetting and file-based detection, aren’t designed to catch it.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
