"Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks and user prompts by forging Chromium's own Secure Preferences integrity values," SOCRadar said.
What PEEP is and how it is delivered
PEEP is a post‑exploitation toolkit that masquerades as a bookmarks extension for Chromium-based browsers and requires an existing compromise to deploy. It does not contain an initial access vector itself: an operator must already have administrative or code‑execution access to a target machine to install it. The installer places a fake extension (named "Smart Bookmarks", ID: ejkndncpkdcjcikfhiamcdehdoegilbj) directly into Chrome or Edge profiles and forges Chromium's Secure Preferences values to make the extension appear legitimate and auto-enabled.
Installation routines and persistence mechanisms
PEEP uses multiple sideloading and policy manipulation techniques to persist in browser environments. The toolkit leverages Developer Mode sideloading and edits preference integrity to avoid Web Store checks. Deliveries and persistence steps identified in the codebase include three PowerShell scripts: install_silent.ps1 (enables Developer Mode), patch_secure_prefs.ps1 (patches the Secure Preferences file), and force_enable.ps1 (removes the extension from Preferences’ external_uninstalls, places the CRX at %LOCALAPPDATA%PEEPcrx, re‑registers via the HKCU Extensions key and an External Extensions JSON manifest, and restarts the browser).
PEEP also uses enterprise policy mechanisms — ExtensionInstallForcelist or ExtensionSettings — and a ScriptCache fallback to maintain activation. A Python script named patch_secure_prefs_linux.py indicates the same preference‑tampering approach is being replicated for Linux targets.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildFrom browser telemetry to host‑level backdoor: capabilities and architecture
At its core, PEEP combines an in‑browser agent with a native messaging host to cross the browser sandbox. The extension runs a beacon loop that polls a command‑and‑control (C2) server every 30 seconds over plaintext HTTP (observed C2 endpoints: 206.237.30[.]232 and xfjcc[.]fun). The extension harvests browser artifacts — cookies, recent history, open tabs, active URL, public IP, locale and time zone — and sends those to the C2.
For tasks that require operating system access, the extension invokes a native executable named nm_host.exe (registered as com.peep.lab/nm_host.exe). That native‑messaging bridge allows the operator to run shell commands, manage files, and enumerate processes and services from the user context, elevating PEEP from a credential harvester to a persistent remote‑access tool.
A companion content script (content.js) is injected across active web pages to enable browser‑side capabilities such as screenshots, clipboard access, and JavaScript injection. SOCRadar emphasizes that because much of PEEP's logic executes inside the signed browser process, it can evade detections that focus on unsigned binaries.
Command-and-control, telemetry, and the evidence on the server
SOCRadar mapped a set of web endpoints used by the C2 panel. Identified endpoints include:
- /api/register — register the infection
- /api/commands — where the extension polls for new commands
- /api/agents/<id>/heartbeat — sends browser User‑Agent, OS, and time zone
- /api/extension_update/ and /api/extension_crx/ — extension update channels
- /api/agents/<id>/task_result — posts command results
- /api/exfil — posts auto‑collected browser data and metadata
- /health — internal system status (no login required)
- /login — the C2 panel login interface (port 5001)
The /health endpoint observed by SOCRadar showed 34 agent entries, 10 active sessions, and 507 data records. SOCRadar cautions there is no reliable way to distinguish between test entries and confirmed infected hosts in that record set.
Lineage and attribution cues
PEEP builds on an open‑source framework called RedExt — a browser data analysis and red‑teaming toolkit previously linked to GlassWorm activity — but extends that base with dedicated installation routines, a native host bridge, heartbeat telemetry, an update channel, and a wider command set. Those extensions make PEEP a derivative of RedExt, according to the research.
SOCRadar also noted Chinese‑language artifacts in the source code, which the report says point to a Chinese‑speaking operator, though SOCRadar stopped short of attributing the activity to a named group.
What this means for security teams, enterprises, and end users
Security teams should prioritize detection pathways that surface tampering of Chromium Secure Preferences, unexpected CRX files under %LOCALAPPDATA% (e.g., %LOCALAPPDATA%PEEPcrx), and the presence of a native messaging host named com.peep.lab or nm_host.exe. The use of enterprise force‑install policies as an abuse vector means that policy configuration and the integrity of ExtensionInstallForcelist/ExtensionSettings entries are relevant telemetry.
Enterprises and procurement leads must be aware that force‑installed or sideloaded extensions can be weaponized post‑compromise; the existence of an update channel (/api/extension_update/ and /api/extension_crx/) means an operator can modify capabilities after initial deployment.
End users should note that PEEP requires prior administrative or code execution access to install — it is a post‑compromise tool — but once present it can exfiltrate cookies, history, active‑tab metadata, and session tokens and can be used to run OS commands via native messaging, enabling credential theft and session hijacking.
PEEP converts the browser — a heavily trusted, signed process on many endpoints — into a persistent pivot to the OS by abusing the native messaging bridge and preference integrity. The visible server activity raises immediate operational questions: which of the 34 recorded agents are live compromises and where else have similar sideloading and Secure Preferences tampering techniques been used? SOCRadar's findings supply concrete indicators and techniques for detection, but also underscore that the decisive control point for PEEP is the preexisting breach that lets an operator place the tool in the first place.
