A newly documented toolkit called PEEP is a reminder that browser security cannot stop at blocking malicious websites or policing extensions from official stores. According to reporting based on SOCRadar research, PEEP is a post-compromise framework that abuses Chromium-based browsers after an attacker has already gained administrative or code execution access on a host. Its goal is not simply to spy on browser activity. It turns Chrome and Edge profiles into a durable control point for credential theft, session abuse, file operations, and command execution.
That distinction matters for defenders. PEEP is not described as an initial access exploit, so organizations should not treat it as a standalone infection chain. Instead, it represents what can happen after a workstation is already breached and the attacker wants stealthy persistence inside software that users and security teams expect to see running all day: the browser.
What PEEP does after a host is compromised
PEEP masquerades as a bookmarks-related extension called “Smart Bookmarks,” but its behavior is closer to a remote access and browser-monitoring implant. The installer reportedly injects the extension directly into Chrome or Edge profiles rather than relying on a normal marketplace installation flow. Researchers said it can manipulate Chromium’s Secure Preferences integrity values, use sideloading methods, and rely on enterprise-style force-install settings to keep the extension enabled.
Once active, the extension regularly contacts command-and-control infrastructure over plaintext HTTP to request tasks. The reported polling interval is every 30 seconds. During that loop, it can collect browser artifacts such as cookies, browsing history, active-tab information, active URLs, locale, public IP details, and time zone information. Those data points are especially valuable because modern attacks often aim to reuse authenticated sessions rather than steal only passwords.
The more concerning capability is the native messaging bridge. Chromium’s Native Messaging feature is intended to let a browser extension communicate with an installed local application. In legitimate environments, that can support password managers, endpoint agents, or enterprise integrations. In PEEP’s case, researchers reported an auxiliary executable named nm_host.exe that lets the browser extension reach outside the browser sandbox and run operating-system-level actions, including shell commands, file management, and local discovery.
Why browser-based persistence is hard to spot
Security teams often focus their highest-fidelity detections on new executables, unsigned binaries, persistence in common autorun locations, or suspicious PowerShell activity. PEEP complicates that model because important logic runs through the browser and its extension mechanisms. Chrome and Edge are signed, common, internet-facing applications that generate high volumes of normal activity. That makes malicious browser extension behavior easier to blend into the background unless defenders collect and correlate the right telemetry.
The reported toolkit also appears to include scripts that help enable developer mode, patch Secure Preferences, re-register the extension, remove uninstall markers, place CRX files under local application paths, and restart the browser. A Linux-focused Python script was also reportedly observed for similar Secure Preferences manipulation, indicating that defenders should avoid assuming this technique is Windows-only.
PEEP is also described as building on RedExt, an open-source browser data analysis and red-team framework. That lineage is important: offensive frameworks and proof-of-concept tooling can reduce development time for malicious operators. Even when a tool begins in a research or testing context, defenders should monitor for real-world tradecraft that adapts it for persistence, automated harvesting, and command execution.
Practical detection ideas
Organizations should start by inventorying extensions installed in managed Chrome and Edge profiles. Look for extensions that are not approved, not sourced from official stores, or installed through local sideloading paths. The reported PEEP extension ID is ejkndncpkdcjcikfhiamcdehdoegilbj, and defenders should also review any suspicious “Smart Bookmarks” entries. However, do not rely only on names or IDs, because either can change in future variants.
Review enterprise browser policies such as ExtensionInstallForcelist and ExtensionSettings. These controls are legitimate in managed environments, but unexpected changes should be treated as high priority, especially when applied at user scope or introduced outside normal device management channels. Monitor registry keys, JSON external extension manifests, local CRX drop locations, and changes to Chrome or Edge profile preference files.
Native messaging host registrations deserve special attention. Build a baseline of approved native messaging hosts and alert on new entries, unusual host paths, unsigned helper binaries, or host names that do not match known enterprise software. The browser-to-native-app boundary is powerful; when abused, it can convert what appears to be a browser extension incident into full endpoint control.
Network monitoring can add another layer. Plaintext HTTP beaconing from browser processes to unusual infrastructure, periodic polling patterns, or repeated requests to command-style API paths should be investigated. Because attackers can change infrastructure quickly, behavioral indicators are more resilient than a single domain or IP address.
Response guidance for security teams
If PEEP-like activity is suspected, treat the endpoint as already compromised. Removing the extension may not be enough if the original access vector, helper executable, policy change, or re-registration script remains in place. Isolate the device, preserve browser profile artifacts, collect endpoint telemetry, and review recent administrative actions. Reset credentials and revoke browser sessions for affected users, because harvested cookies or tokens can allow account access even after password changes.
For prevention, enforce extension allowlisting, restrict developer mode where possible, control who can change browser policies, and harden script execution. Endpoint detection rules should include browser profile tampering, Secure Preferences modification, unexpected native messaging host creation, suspicious CRX placement, and browser processes communicating with low-reputation infrastructure.
PEEP is a practical warning: the browser is now part of the endpoint attack surface, not just a window to the web. A distinctive defensive takeaway is that browser profiles should be monitored like persistence locations, because an attacker who owns the profile may also own the session.
Source: The Hacker News source