PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution
PEEP is a Chromium-based post-compromise toolkit that masquerades as a "Smart Bookmarks" extension to turn Chrome and Edge browsers into persistent backdoors for host-level command execution It bypasses Web Store checks and user prompts by forging Chromium's Secure Preferences integrity values and leveraging native messaging to escape the browser sandbox Built on the open-source RedExt framework, PEEP adds dedicated installation routines, a native host bridge (nm_host.exe), heartbeat telemetry,
Analysis
TL;DR
- PEEP is a Chromium-based post-compromise toolkit that masquerades as a "Smart Bookmarks" extension to turn Chrome and Edge browsers into persistent backdoors for host-level command execution
- It bypasses Web Store checks and user prompts by forging Chromium's Secure Preferences integrity values and leveraging native messaging to escape the browser sandbox
- Built on the open-source RedExt framework, PEEP adds dedicated installation routines, a native host bridge (nm_host.exe), heartbeat telemetry, and an update channel
- The malware exfiltrates browsing history, session cookies, active-tab metadata, and credentials while executing arbitrary shell commands, managing files, and hijacking sessions via a C2 server polling every 30 seconds over plaintext HTTP
- Evidence suggests a Chinese-speaking threat actor may have used "Authorized CTF" framing to bypass AI safety guardrails during malware development
Why It Matters
PEEP demonstrates a sophisticated evasion technique where the browser itself becomes the persistence mechanism and execution pivot, bypassing traditional endpoint detection by running malicious logic inside a signed browser process. This represents a growing class of browser-based post-exploitation tools that blur the line between legitimate browser functionality and malware, challenging conventional security monitoring approaches.
Technical Details
- Installation & Persistence: PEEP uses three PowerShell scripts (install_silent.ps1, patch_secure_prefs.ps1, force_enable.ps1) to enable Developer Mode, sideload the extension, forge Secure Preferences integrity values, and ensure auto-enable on browser launch. It also leverages ExtensionInstallForcelist and ExtensionSettings policies for enterprise force-install scenarios, with a Linux variant using patch_secure_prefs_linux.py.
- Native Messaging Bridge: The auxiliary executable nm_host.exe (registered as com.peep.lab) acts as a native messaging host that bridges browser commands to OS-level operations, enabling shell command execution, file management, process discovery, and service enumeration while operating in the user context.
- C2 Communication: The extension polls C2 servers (206.237.30[.]232 or xfjcc[.]fun) every 30 seconds over plaintext HTTP, using endpoints including /api/commands for tasking, /api/exfil for auto-collected data, /api/register for infection registration, /api/agents/
/heartbeat for telemetry, and /api/extension_update/ for self-updates. - Data Exfiltration & Capabilities: Harvests browsing history, active-tab metadata, session cookies, public IP, locale, and timezone. Browser-based commands (screenshots, clipboard access, JavaScript injection) run locally via content.js embedded across all pages, while OS-level tasks are routed through the native host bridge.
- Evasion Techniques: Runs inside the signed Chrome/Edge process to bypass detection of new or unsigned binaries. Bypasses Web Store verification by manipulating Secure Preferences and using sideloading tricks. The /health endpoint exposes internal system status without authentication.
Industry Insight
- Security teams should prioritize monitoring for anomalous native messaging host registrations and unexpected modifications to Chromium Secure Preferences files, as these are key indicators of PEEP-style infections that evade traditional binary-focused detection.
- The use of AI tools with "Authorized CTF" framing to lower safety guardrails during malware development highlights the need for enhanced AI usage monitoring and the implementation of stricter guardrails around code-generation tools in organizational environments.
- Organizations should audit Chrome/Edge extension policies, particularly ExtensionInstallForcelist and ExtensionSettings, and implement application control policies that restrict unauthorized native messaging hosts to prevent browser-based persistence mechanisms from establishing OS-level access.
Disclaimer: The above content is generated by AI and is for reference only.