PEEP Toolkit Turns Chrome and Edge into Backdoors for Host Command Execution
A new post-exploitation toolkit named PEEP leverages Chrome and Edge browser extensions to establish a backdoor for executing commands on compromised hosts, bypassing standard security checks.
Cybersecurity researchers have detailed a sophisticated post-exploitation toolkit called PEEP, which weaponizes browser extensions for Google Chrome and Microsoft Edge to achieve host command execution. Requiring prior administrative access, PEEP injects itself directly into browser profiles as a seemingly innocuous bookmarks extension. This method bypasses the usual security checks of browser web stores by manipulating Chromium's internal "Secure Preferences" file, allowing attackers to gain a persistent foothold.
Once installed, the PEEP "extension" agent operates as a backdoor, communicating with its command-and-control (C2) server every 30 seconds via unencrypted HTTP. It polls for new commands and exfiltrates sensitive browser data, including browsing history, active tab metadata, and session cookies. Beyond data theft, PEEP functions as a comprehensive remote access tool, capable of executing arbitrary host commands, stealing credentials, hijacking user sessions, and even altering displayed web pages.
The toolkit is built upon the foundation of RedExt, an open-source framework for browser data analysis and red teaming. However, PEEP significantly expands upon this base with dedicated installation routines, a native host bridge for deeper system interaction, robust heartbeat telemetry, an update mechanism, and an expanded command set, making it a potent derivative of its predecessor.
PEEP is classified as a post-compromise framework because it lacks an initial access vector. This means attackers must first breach a target system through other means before deploying PEEP. While the activity remains unattributed, the presence of Chinese-language artifacts within the toolkit's source code strongly suggests a Chinese-speaking threat actor is behind its development and deployment.
The malicious extension masquerades as "Smart Bookmarks" and is responsible for the core beaconing loop, data harvesting, and receiving further instructions. When a task requires operating system-level access, the browser add-on invokes an auxiliary executable, "nm_host.exe." This native messaging host binary transforms PEEP from a simple credential stealer into a powerful remote-access tool, enabling it to execute shell commands, manage files, and discover running processes and services.
To maintain persistence and evade detection, PEEP employs several techniques. It leverages enterprise force-install policies, manipulates preference integrity values, and uses a "ScriptCache" fallback. The malware also utilizes PowerShell scripts like install_silent.ps1 to enable Developer Mode for sideloading extensions and patch_secure_prefs.ps1 to tamper with the Secure Preferences file, ensuring the extension remains active. A Python script for Linux environments indicates the threat actor's intent to expand its reach beyond Windows.
PEEP's ability to modify the Secure Preferences file is crucial for its persistence, ensuring the extension automatically enables itself upon browser launch. Since it's not available on official marketplaces, delivery relies on methods like enterprise ExtensionInstallForcelist or ExtensionSettings policies, or sideloading tricks. The toolkit also communicates with various C2 endpoints for registration, heartbeat signals, extension updates, task results, data exfiltration, and internal system status.
While the exact targets remain unknown, telemetry data suggests a potentially active campaign. The C2 server's /health endpoint has shown entries for 34 agents, 10 active sessions, and 507 data records, though these numbers could include testing or verification entries. The browser, in this scenario, becomes a critical pivot point, allowing attackers to bypass sandbox restrictions and execute commands directly on the host operating system, facilitating credential theft, session abuse, and broader network compromise.