PEEP Turns Chrome and Edge Into Persistent Backdoors After a Host Breach

Cybersecurity researchers have documented PEEP, a post-exploitation framework that embeds surveillance, data theft, and remote-control capabilities inside Google Chrome and Microsoft Edge. It masquerades as a browser extension called “Smart Bookmarks”, but its functions extend well beyond the browser.

PEEP is not an initial-access tool. Attackers must first obtain administrative privileges or execute code through another mechanism. Once deployed, the framework can steal cookies and credentials, monitor browsing, alter web pages, and run commands on the underlying operating system.

The findings entered public reporting on September 7, 2026. No confirmed victims, affected organizations, or definitive operator have been identified.

A malicious extension backed by a native host

PEEP’s main component is a Chromium extension with the identifier:

ejkndncpkdcjcikfhiamcdehdoegilbj

The extension targets Chrome and Edge profiles, although the exact affected browser versions have not been disclosed. Because it is installed after the endpoint is compromised, the operation does not depend on exploiting a known browser vulnerability.

The browser component polls command-and-control infrastructure, collects browsing artifacts, receives tasks, and returns results. It can perform several actions directly within the browser context, including:

• Reading browsing history and active-tab information
• Stealing cookies, credentials, and session data
• Capturing clipboard contents and screenshots
• Injecting JavaScript into active pages
• Modifying web content
• Monitoring URLs and browser activity
• Downloading extension updates from the operator’s infrastructure

A content.js script is injected into active web pages, giving the extension visibility into and control over content loaded by the user.

For operations outside the browser, PEEP uses Chromium’s Native Messaging mechanism. The associated executable is referenced as:

com.peep.lab/nm_host.exe

This bridge allows the extension to launch shell commands, manage files, and enumerate processes and services. It effectively converts a malicious browser add-on into a remote-access mechanism for the host.

The architecture also complicates detection. Much of the malicious logic runs within a legitimate, signed browser process, so security controls focused primarily on unsigned executables or unfamiliar standalone processes may miss critical activity. The native host remains an important detection point, particularly when Chrome or Edge unexpectedly launches command interpreters or system utilities.

From RedExt tooling to a broader post-exploitation platform

PEEP is derived from RedExt, an open-source framework designed for browser-data analysis and red-team operations. RedExt has also appeared in GlassWorm attacks.

The new framework retains parts of that foundation but introduces features intended for sustained access. These additions include automated deployment routines, heartbeat telemetry, extension updates, a native messaging bridge, and an expanded command set.

That distinction matters operationally. A basic malicious extension might collect browser records once and send them to an attacker. PEEP establishes a recurring task channel, continuously reports information about the infected environment, and accepts new instructions.

After initialization, the extension reads configuration data containing its command-and-control settings. It then contacts the server every 30 seconds over unencrypted HTTP.

Observed endpoints include:

Path	Purpose
/api/register	Registers a new agent
/api/agents/<id>/heartbeat	Reports the User-Agent, operating system, and time zone
/api/commands	Retrieves pending tasks
/api/agents/<id>/task_result	Uploads command results
/api/exfil	Sends collected browser and host data
/api/extension_update/	Checks for extension updates
/api/extension_crx/	Downloads the CRX package
/health	Exposes system-status information without authentication
/login	Provides access to the control panel on port 5001

Data sent to /api/exfil can include cookies, recent history, open tabs, the active URL, public IP address, locale, and time zone.

The identified command-and-control indicators are:

206.237.30[.]232
xfjcc[.]fun

The fixed polling interval, plaintext communications, and distinctive API paths give defenders several opportunities for network-based detection.

Browser preference tampering provides persistence

PEEP is not distributed through the Chrome Web Store or another official extension marketplace. Instead, its deployment routines bypass normal extension-installation controls through sideloading, enterprise policies, and direct modification of Chromium profile data.

A central technique targets the browser’s Secure Preferences file. The installer changes extension settings and forges integrity-related preference values so that Chrome or Edge automatically enables the add-on without the normal validation process or user approval.

The framework can also abuse:

• ExtensionInstallForcelist
• ExtensionSettings
• Enterprise-style force-install policies
• Direct extension sideloading
• A ScriptCache fallback

Several deployment scripts reveal how installation and recovery are handled:

• install_silent.ps1 enables Developer Mode to allow arbitrary sideloading.
• patch_secure_prefs.ps1 alters the Secure Preferences file.
• force_enable.ps1 removes the extension from the external_uninstalls section, stores a CRX under %LOCALAPPDATA%PEEPcrx, creates extension registrations, and restarts the browser.

The final script uses both the HKCU Extensions registry key and an External Extensions JSON manifest. This gives the operator multiple ways to restore the extension if Chromium disables or removes it.

Researchers also identified patch_secure_prefs_linux.py, indicating work to adapt deployment for Linux. The extent of Linux support is unknown, and no Linux victims have been confirmed.

Stolen sessions can outlive password changes

PEEP’s impact is not limited to exposed browsing history. Session cookies can let an attacker impersonate a user on services where authentication has already occurred, potentially bypassing the immediate need to know the account password.

The framework’s JavaScript injection and page-modification capabilities introduce further risks. An operator could alter content displayed in the browser, collect data entered into web pages, or manipulate an authenticated session. Meanwhile, the native host can extend the intrusion into files, running processes, services, and shell operations.

This combination supports several post-compromise objectives:

• Credential and session theft
• Account hijacking
• Browser surveillance
• Host discovery
• File manipulation
• Remote command execution
• Persistent access and tooling updates

The exposed /health endpoint reportedly listed 34 agent entries, 10 active sessions, and 507 data records. Those numbers do not establish the scale of an active campaign. They may include test systems, development records, or duplicate entries, and researchers could not verify them as real infections.

No CVE, CVSS score, vendor severity rating, or official patch is associated with PEEP. It is malware that abuses legitimate browser administration and native messaging features after a compromise, rather than a disclosed software vulnerability. Consequently, there is no relevant CISA Known Exploited Vulnerabilities catalog entry or KEV remediation deadline.

Attribution remains unresolved

The operation has not been linked to a known threat group. Chinese-language artifacts appear in the source code, which may point to a Chinese-speaking developer or operator, but they are not sufficient for attribution.

The code also contains multiple references to “Authorized CTF” activity. One possibility is that the developers framed requests as authorized security testing or capture-the-flag work when using AI systems to assist development and avoid safety restrictions.

That explanation remains unconfirmed. The references could also be development notes, copied material, or deliberate misdirection.

No reliable victim profile has emerged. It is therefore unknown whether PEEP has been used in targeted intrusions, broader criminal activity, controlled testing, or some combination of those scenarios.

What defenders should investigate now

Organizations should treat any PEEP discovery as evidence of a wider endpoint compromise. Removing the extension alone does not address the initial intrusion, stolen sessions, altered browser profiles, or commands already executed through nm_host.exe.

Priority actions include:

1. Search Chrome and Edge profiles for “Smart Bookmarks” and extension ID ejkndncpkdcjcikfhiamcdehdoegilbj.
2. Block and investigate traffic involving 206.237.30[.]232, xfjcc[.]fun, port 5001, or the documented API paths.
3. Look for HTTP requests every 30 seconds, especially from browser processes.
4. Audit ExtensionInstallForcelist and ExtensionSettings for entries that administrators did not authorize.
5. Examine Secure Preferences and Preferences files for forced-enable settings, suspicious integrity changes, and modifications to external_uninstalls.
6. Hunt for deployment files, including install_silent.ps1, patch_secure_prefs.ps1, force_enable.ps1, patch_secure_prefs_linux.py, content.js, nm_host.exe, and CRX files under %LOCALAPPDATA%PEEPcrx.
7. Review Native Messaging registrations associated with com.peep.lab/nm_host.exe.
8. Investigate browser-spawned processes, shell execution, file operations, and process or service enumeration.
9. Revoke active sessions and rotate exposed credentials, rather than relying on password changes alone.
10. Preserve forensic evidence and rebuild trust in the endpoint before returning it to service.

The initial access vector may remain elsewhere on the machine. A complete response should determine how the attacker first obtained code execution, what PEEP collected, and whether the operator established additional persistence outside the browser.