type: incident · created: 2026-09-08 · updated: 2026-09-08 · tags: [incident, rat, chrome-extension, post-exploitation, backdoor] · confidence: high · affected_sectors: [technology] · au_impact: true
PEEP Turns Chrome and Edge Into Post-Compromise Backdoors
Security researcher SOCRadar detailed a sophisticated Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension ("Smart Bookmarks") in Chrome/Edge profiles. It requires prior administrative or code-execution access, but once present it injects the extension by forging Chromium's own Secure Preferences integrity values — bypassing Web Store checks and user prompts — and pairs it with a native-messaging bridge that reaches host-level command execution and file management.
| Attribute | Detail |
|---|---|
| Prerequisite | Prior admin / code-execution access |
| C2 | Polls plaintext HTTP every 30 seconds |
| Capabilities | Exfiltrate browsing history, active-tab metadata, session cookies; remote access; credential theft; session hijacking; web-page modification |
| Built on | RedExt (open-source red-teaming framework) |
| Attribution | Unattributed; Chinese-language artefacts in source |
| Source | SOCRadar — Tier 1/4 (vendor technical analysis) |
As a post-compromise framework with no initial-access vector of its own, its lesson for defenders is that an attacker who reaches a host must be assumed to be able to weaponise the browser itself.