PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution
Summary: SOCRadar disclosed a Chromium post-exploitation toolkit called PEEP that masquerades as a "Smart Bookmarks" extension (ID: ejkndncpkdcjcikfhiamcdehdoegilbj), injecting itself into Chrome and Edge profiles by forging Chromium's Secure Preferences integrity values and bypassing Web Store checks and user prompts. Once installed, the extension polls a command-and-control server at 206.237.30[.]232 or xfjcc[.]fun every 30 seconds over plaintext HTTP, exfiltrating browsing history, active-tab metadata, and session cookies while using a native-messaging binary (nm_host.exe) to run host commands, manage files, and steal credentials.
What's compelling: Because PEEP's logic runs inside the signed browser process, it slips past detection built for new or unsigned binaries, turning Chrome and Edge into an endpoint pivot for credential theft and command execution. The operator's /health endpoint showed 34 agent entries, 10 active sessions, and 507 data records, with no way to separate real infected hosts from test entries.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026