PEEP forges Chrome's own integrity checks
SOCRadar documented PEEP, a fake Smart Bookmarks extension that rewrites Chromium Secure Preferences HMACs, installs with no Web Store prompt, and runs host shell commands.
Your extension inventory is a list the browser gives you. PEEP is a Chromium post-compromise toolkit that edits that list and re-signs it. SOCRadar's Threat Research Unit published the analysis of a build disguised as Smart Bookmarks v1.3.0, and the interesting part is not the payload — it is that Chrome reports the extension as legitimately installed.
What actually happened
PEEP's installer writes the extension directly into Chrome and Edge profile directories, then rewrites Chromium's Secure Preferences file — recomputing the per-entry HMACs and the top-level super_mac so the browser's own tamper check passes. No Web Store submission, no install prompt, no red banner. SOCRadar found the sideload scripted in install_silent.ps1, patch_secure_prefs.ps1 and force_enable.ps1, with patch_secure_prefs_linux.py for Linux profiles. Persistence also uses the ExtensionInstallForcelist and ExtensionSettings enterprise policy keys — the same mechanism your IT provider uses to push approved extensions.
A native messaging host registered as com.peep.lab, backed by nm_host.exe, takes it past browser telemetry into host shell commands, file management, and process and service enumeration. The agent polls its C2 every 30 seconds over plaintext HTTP, to 206.237.30[.]232 and xfjcc[.]fun variants. It collects session cookies, browsing history, open-tab metadata, bookmarks, downloads, DOM content, local and session storage, clipboard, screenshots and form fields.
PEEP is built on RedExt, an open-source browser red-teaming framework, and it is post-compromise only: an operator needs admin or code execution on the machine first. SOCRadar captured a server snapshot showing 34 agent entries and 10 active sessions, but flagged that test identifiers are mixed in — so treat that as scale of the operator's lab, not a victim count. The activity is unattributed.
Why it matters for your business
Count what a browser on a working laptop is currently logged into: Shopify admin, the AWS console, Stripe, GitHub, Google Workspace, your bank. Those are live session cookies. Stealing them skips the password and skips MFA, because the login already happened.
The control most teams rely on — "we review installed extensions" — assumes the browser is telling the truth about what is installed. PEEP is a working demonstration that it does not have to. Detection moves down a layer: audit native messaging host registrations under the registry and NativeMessagingHosts directories, diff the ExtensionInstallForcelist policy against your approved list, and alert on outbound plaintext HTTP arriving on a metronome.
Key takeaways
- PEEP forges Chromium Secure Preferences HMACs and the super_mac value, so a sideloaded extension appears legitimately installed
- It abuses ExtensionInstallForcelist and ExtensionSettings — the same enterprise policy keys your IT provider uses
- A com.peep.lab native messaging host reaches past the browser into shell commands and file operations
- C2 beacons every 30 seconds over plaintext HTTP to 206.237.30[.]232 and xfjcc[.]fun; stolen session cookies bypass MFA entirely
- Post-compromise only — it needs admin or code execution first, so this is a second-stage problem, not an initial-access one
If a stolen cookie can reach your admin panel, the login page was never the control. We map which browsers hold live sessions to your revenue systems, cut the session lifetimes that nobody set, and put device-bound checks in front of the panels that matter. Book a stack audit or see how we work.
Sources: SOCRadar: PEEP browser RAT Chrome extension, The Hacker News.
- #chrome
- #browser-security
- #malware
- #extensions
- #socradar
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
VMware Workstation VM escape: get to 26H1u1
CVE-2026-59346 is a CVSS 9.3 integer overflow in the VMXNET3 adapter that lets a VM admin run code on the host. No workaround. Your sandbox is not a boundary.
Read itSonicWall SMA1000: CVSS 10 SSRF chained to pre-auth RCE
Two SonicWall SMA1000 zero-days are under active attack. A CVSS 10.0 pre-auth SSRF chains with command injection for unauthenticated RCE on your VPN box.
Read it