- The Mess: Attackers are planting a fake “Smart Bookmarks” extension inside Chrome and Edge, forging Chromium’s own integrity data to make it stick. Then Native Messaging turns the browser into a host-level command channel.
- The Damage: PEEP can steal cookies, browsing history and sessions while executing commands and managing files on the underlying machine.
- The Fix: Audit browser extensions and profiles, block unmanaged sideloading, and hunt for suspicious changes to Chromium’s
Secure Preferences.
This isn’t a Chrome zero-day.
There is nothing to patch.
That’s what makes PEEP interesting.
Researchers from SOCRadar uncovered a Chromium-based post-exploitation toolkit that masquerades as a harmless bookmarks extension called “Smart Bookmarks.” It targets Chrome and Edge and requires the attacker to already have administrative privileges or code execution on the machine.
The browser is simply where the attacker decides to live.
The extension doesn’t need the Web Store
PEEP’s installer injects the malicious extension directly into the browser profile.
It then modifies Chromium’s Secure Preferences data and forges the integrity values Chromium uses to detect unauthorized changes.
The result is ugly: the extension can be loaded without going through the normal Web Store installation flow or asking the user for permission.
The malware also has several persistence options, including sideloading, enterprise extension policies and a fallback mechanism designed to restore the extension if someone removes it.
So checking chrome://extensions once isn’t necessarily enough.
The attacker has built redundancy into the installation process.
Then Native Messaging breaks the browser boundary
This is where PEEP stops looking like a credential stealer.
Chromium’s Native Messaging mechanism allows browser extensions to communicate with native applications installed on the operating system.
PEEP abuses that bridge.
Its extension can invoke an auxiliary executable called nm_host.exe, giving the operator access to functionality outside the browser sandbox. Researchers observed capabilities for running shell commands, managing files and discovering processes and services.
The browser becomes the command interface.
And because Chrome or Edge is already trusted software, that can make the activity considerably harder to distinguish from legitimate browser behaviour.
Cookies are the real prize
PEEP doesn’t just collect generic browser telemetry.
It targets:
- session cookies
- browsing history
- active tabs
- URLs
- credentials
- clipboard data
- screenshots
- browser metadata
That creates a second problem after the endpoint compromise.
A stolen password can be reset.
A stolen authenticated session may not need the password at all.
An attacker who captures an active session can potentially access web applications as the victim until the session is invalidated.
For corporate environments, that can mean email, SaaS platforms, internal dashboards and administrative portals sitting behind the browser.
The C2 is almost embarrassingly simple
PEEP periodically contacts its command-and-control infrastructure.
The researchers observed beaconing approximately every 30 seconds, with communication taking place over plaintext HTTP.
The malware uses separate endpoints for registration, heartbeat traffic, task delivery, updates and exfiltration.
That creates an interesting detection opportunity.
A browser making ordinary HTTPS connections is boring.
A browser process repeatedly talking to an unfamiliar endpoint, while a native messaging host appears on the machine and the profile’s security metadata changes, is something defenders should investigate.
PEEP is not initial access
This distinction matters.
PEEP doesn’t magically compromise Chrome.
The attacker first needs another way onto the machine — stolen credentials, malware, exploitation or some other foothold.
PEEP is what comes next.
It is persistence, surveillance and remote control.
That makes it much closer to a browser-based RAT than a conventional malicious extension.
And because the browser already touches so much sensitive information, the attacker doesn’t have to install a giant collection of specialised spyware.
One extension can become the collection point.
Bugstoday Opinion
The interesting lesson from PEEP isn’t that malicious browser extensions exist.
Everyone knows that.
The problem is where the browser ends and the operating system begins.
Native Messaging was designed to make useful browser integrations possible.
PEEP turns that same bridge into a remote-control channel.
And the attacker doesn’t need to break Chrome.
They just need to get inside the machine first and make the browser believe the malware belongs there.
Your browser is no longer just where the attacker steals the cookie. It can become where the attacker stays.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- SOCRadar / Threat Research Unit — PEEP analysis
- The Hacker News — PEEP technical overview
- Chromium Native Messaging documentation
- MITRE ATT&CK — Browser Extensions / T1176
