Once installed, it can turn Google Chrome or Microsoft Edge into a persistent backdoor for stealing browser data, hijacking sessions, and executing commands on the victim’s computer.
PEEP is not an initial-access malware family. Attackers first need administrative access or the ability to run code on a target system.
They can then silently place the malicious extension into Chrome or Edge profiles, bypassing normal Web Store installation checks and user approval prompts.
The toolkit was identified by SOCRadar’s Threat Research Unit through its Extended Threat Intelligence platform.
Researchers found that PEEP is derived from the open-source RedExt framework, but adds stealthy installation methods, browser persistence, host-level control, and expanded data-theft features.
Malicious Chrome Extension Backdoor
The malicious extension uses a Manifest V3 service worker and runs in the signed browser process. This can help it avoid security tools that mainly look for suspicious new executable files.
PEEP collects browser cookies, browsing history, bookmarks, active tabs, downloads, browser settings, public IP address, language, time zone, and other system details.
Stolen cookies are especially dangerous because attackers may use them to hijack authenticated sessions without needing a victim’s password.
The extension can also capture web-page content, local storage, session storage, screenshots, clipboard data, submitted forms, and password-like fields. It can open websites or inject JavaScript into eligible web pages.
More importantly, PEEP uses Chrome’s native-messaging capability to communicate with a separate host-side component called nm_host.exe.
This bridge allows the extension to escape the browser sandbox and interact with the underlying operating system in the logged-in user’s context.
Through this native host, attackers can run shell commands, list processes and services, search directories, read files, write files, and delete files. In effect, a seemingly harmless browser extension can operate as a remote-access tool.
PEEP maintains persistence through several techniques. Its installers can manipulate Chromium Secure Preferences integrity values, use enterprise force-install policies, sideload extensions, and rely on a ScriptCache fallback method.
These layers make removal more difficult because deleting one component may not fully eliminate the threat. The malware communicates with its command-and-control server every 30 seconds using unencrypted HTTP.
It was observed contacting the IP address 206.237.30[.]232, associated with domains including xfjcc[.]fun.
The same infrastructure reportedly hosted the operator panel, payload distribution system, and an exposed development repository, SOCRadar said.
Indicators of Compromise
| IOC Type | Indicator | Details |
|---|---|---|
| C2 / payload host | 206.237.30[.]232 | Primary PEEP command-and-control, payload-distribution, and staging host; observed on TCP ports 5001 and 5002 |
| ASN | AS55933 | Cloudie Limited, Hong |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
