{"id":2730,"date":"2026-09-07T18:47:30","date_gmt":"2026-09-07T18:47:30","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2730"},"modified":"2026-09-07T18:47:30","modified_gmt":"2026-09-07T18:47:30","slug":"peep-turns-chrome-and-edge-into-post-compromise-backdoors-for-host-command-execution","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2730","title":{"rendered":"PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution"},"content":{"rendered":"
\n
<\/a><\/div>\n

Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP<\/strong> that masquerades as a bookmarks extension for the web browser.<\/p>\n

\u00abRequiring prior administrative or code execution access, its installer injects the extension directly into Chrome\/Edge profiles, bypassing Web Store checks and user prompts by forging Chromium’s own Secure Preferences integrity values,\u00bb SOCRadar said<\/a>. \u00abA native-messaging tool then extends it beyond browser telemetry to host-level command execution and file management.\u00bb<\/p>\n

Once installed, the PEEP \u00abextension\u00bb agent polls its command-and-control (C2) server (\u00ab206.237.30[.]232\u00bb or \u00abxfjcc[.]fun<\/a>\u00ab) every 30 seconds over plaintext HTTP for new commands, while exfiltrating browsing history, active-tab metadata, and session cookies. It also functions as a remote access and browser monitoring toolkit that runs host commands, steals credentials, hijacks sessions, and alters web pages.<\/p>\n

PEEP is built on the foundations of an open-source, browser data analysis and red teaming framework called RedExt, which has also been put to use in prior GlassWorm attacks. However, it expands on the toolkit with dedicated installation routines, a native host bridge, heartbeat telemetry, an update channel, and a broader command set. This, in turn, makes PEEP a derivative of RedExt.<\/p>\n

PEEP is described as a post-compromise framework as it lacks an initial access vector itself, meaning it requires the operator to breach a machine through some other means and deploy the malware. The activity remains unattributed, although the presence of Chinese-language artifacts in the source code points to a Chinese-speaking threat actor.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The extension masquerades as \u00abSmart Bookmarks\u00bb (ID: ejkndncpkdcjcikfhiamcdehdoegilbj). It’s the main agent responsible for executing the beacon loop by polling \u00ab\/api\/commands,\u00bb harvesting browser data, receiving additional tasking, and sending the results back.<\/p>\n

<\/p>\n

The browser add-on also invokes an auxiliary executable (\u00abnm_host.exe\u00bb) when said task requires operating system access, while browser-based commands (e.g., screenshots, clipboard, or JavaScript injection) are run locally. The use of the Native Messaging Host binary<\/a> transforms the malware from a basic credential stealer to a remote-access tool.<\/p>\n

\u00abOperating in the user context, the extension extracts browser artifacts and uses com.peep.lab\/nm_host.exe to run shell commands, manage files, and discover processes and services,\u00bb SOCRadar said. \u00abBypassing Web Store checks, PEEP maintains persistence via sideloading, enterprise force-install policies, preference-integrity manipulation, and a ScriptCache fallback.\u00bb<\/p>\n

\"\"<\/a><\/div>\n

Also used by the extension are several other endpoints –<\/p>\n