Cybersecurity researchers have uncovered PEEP, a Chromium-based post-exploitation toolkit that turns Chrome and Edge into stealthy backdoors after an attacker already has access to a system. The malware poses as a bookmarks extension and uses browser trust to slip past ordinary checks.
PEEP is built to operate after compromise rather than to break in on its own, which means it depends on some earlier intrusion or code execution step. Once installed, it injects itself into browser profiles and forges Chromium Secure Preferences values to bypass warnings, making it harder for users and defenders to notice.
The extension continuously checks its command server for tasks and quietly sends back browsing history, active tabs, cookies, and other session details. It can also steal credentials, hijack sessions, alter web pages, and use a native-messaging helper to run host-level commands and manage files outside the browser sandbox.
Researchers say PEEP appears to be based on RedExt, an open-source browser analysis and red-teaming framework, but it adds stronger persistence and more operational features. It uses multiple delivery and survival methods, including sideloading, enterprise force-install policies, preference tampering, and scripts such as install_silent.ps1, patch_secure_prefs.ps1, and force_enable.ps1.
The safest response is to treat unexpected browser extensions as a serious incident signal, especially if they appear outside the Chrome Web Store or are installed through policy or sideloading. Security teams should inspect browser profiles, review extension force-install settings, monitor for suspicious native-messaging hosts, and check for abnormal outbound traffic to unknown command servers; users should keep browsers updated, remove unknown extensions, use least-privilege accounts, and report signs of session theft or credential abuse immediately.