Full Report
Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser. "Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks and user prompts by forging Chromium's own Secure Preferences
Analysis Summary
# Tool/Technique: PEEP
## Overview
PEEP is a sophisticated Chromium-based post-exploitation toolkit that masquerades as a legitimate browser extension (specifically "Smart Bookmarks"). It functions as a Remote Access Trojan (RAT) and browser monitoring tool. Unlike standard malicious extensions that only steal data, PEEP utilizes a native host bridge to achieve OS-level command execution, file management, and persistence, effectively turning Chrome or Edge into a permanent backdoor.
## Technical Details
- **Type:** Malware / Post-exploitation Framework (Derivative of RedExt)
- **Platform:** Windows (with indicators of Linux support via Python scripts)
- **Capabilities:** Host command execution, credential theft, session hijacking, browser data exfiltration, and web page manipulation.
- **First Seen:** Disclosed September 2026 (Linked to frameworks used in 2025 GlassWorm attacks).
## MITRE ATT&CK Mapping
- **TA0003 - Persistence**
- T1176 - Browser Extensions
- T1547.001 - Registry Run Keys / Startup Folder
- **TA0005 - Defense Evasion**
- T1564.001 - Hidden Files and Directories
- T1553.002 - Code Signing (Forging Chromium Secure Preferences integrity values)
- T1562.001 - Impair Defenses: Disable or Modify Tools
- **TA0007 - Discovery**
- T1012 - Query Registry
- T1082 - System Information Discovery
- **TA0009 - Collection**
- T1185 - Browser Session Hijacking
- T1113 - Screen Capture
- T1115 - Clipboard Data
- **TA0011 - Command and Control**
- T1071.001 - Web Protocols: Hypertext Transfer Protocol
## Functionality
### Core Capabilities
- **Browser Data Exfiltration:** Automatically harvests and exfiltrates cookies, browsing history, active tabs, and metadata.
- **Beaconing:** Polls the C2 server every 30 seconds via plaintext HTTP for tasking.
- **Credential Theft:** Steals stored credentials and hijacks active sessions.
- **Information Gathering:** Collects public IP, locale, timezone, and OS details.
### Advanced Features
- **Native Host Bridge:** Uses `nm_host.exe` via the Chromium Native Messaging API to execute shell commands and manage files outside the browser sandbox.
- **Secure Preferences Tampering:** Forges integrity values in Chromium's "Secure Preferences" file to auto-enable the extension and bypass user prompts/Web Store checks.
- **Multi-Vector Persistence:** Employs Enterprise Force-Install policies (`ExtensionInstallForcelist`), Developer Mode sideloading, and `ScriptCache` fallbacks.
- **Self-Updating:** Features dedicated C2 endpoints (`/api/extension_update/`) to deploy new versions of the extension agent.
## Indicators of Compromise
- **File Names:**
- `nm_host.exe` (Native Messaging Host)
- `install_silent.ps1`
- `patch_secure_prefs.ps1`
- `force_enable.ps1`
- `patch_secure_prefs_linux.py`
- **Extension ID:** `ejkndncpkdcjcikfhiamcdehdoegilbj` (Smart Bookmarks)
- **Network Indicators (Defanged):**
- C2 IP: `206.237.30[.]232`
- C2 Domain: `xfjcc[.]fun`
- URL Paths: `hxxp[:]//<C2>/api/commands`, `/api/register`, `/api/agents/<ID>/heartbeat`, `/api/exfil`
- **Registry Keys:**
- `HKCU\Software\Google\Chrome\Extensions\ejkndncpkdcjcikfhiamcdehdoegilbj`
- `HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist`
## Associated Threat Actors
- **Unattributed:** Currently linked to a Chinese-speaking threat actor (based on Chinese-language artifacts in source code).
- **Related Activity:** Evolution of the **GlassWorm** (or similar RedExt-based) activity groups.
## Detection Methods
- **Signature-based:** Detect the specific extension ID and `nm_host.exe` hash.
- **Behavioral detection:**
- Monitor for unauthorized modifications to Chromium `Secure Preferences` files.
- Alert on PowerShell scripts modifying browser policy registry keys (`ExtensionInstallForcelist`).
- Detect non-standard binaries communicating via the Chrome Native Messaging protocol.
- **Network:** Monitor for frequent, small HTTP POST requests to the identified C2 endpoints.
## Mitigation Strategies
- **Policy Restrictions:** Use Group Policy Objects (GPO) to restrict extension installations to a "Whitelist Only" (Allow list) policy.
- **Administrative Control:** Implement Principle of Least Privilege (PoLP); PEEP requires administrative or code execution access for its initial installer.
- **Integrity Monitoring:** Monitor changes to the `%LOCALAPPDATA%\Google\Chrome\User Data\Default\Secure Preferences` file.
- **Endpoint Security:** Utilize EDR solutions to block unauthorized PowerShell execution and suspicious Native Messaging host registrations.
## Related Tools/Techniques
- **RedExt:** The open-source framework upon which PEEP is built.
- **GlassWorm:** A malware family previously observed using similar browser-based post-exploitation techniques.