As reported by The Hacker News, researchers at SOCRadar have disclosed PEEP, a post-exploitation toolkit that injects a malicious Chromium extension directly into browser profiles, bypassing Web Store integrity checks and escalating from browser telemetry theft to host-level command execution via a native messaging host binary. This is not a new initial access vector — it is a persistence and escalation framework that presupposes the attacker already has a foothold.

Threat Alert: As reported by The Hacker News, researchers at SOCRadar have disclosed PEEP, a post-exploitation toolkit that injects a malicious Chromium extension directly into browser profiles, bypassing Web Store integrity checks and escalating from browser telemetry theft to host-level command execution via a native messaging host binary.

What makes PEEP worthy of attention is not novelty in any single component, but the deliberate engineering of a dual-layer backdoor that exploits the trust boundary between the browser sandbox and the host operating system.

Why the Secure Preferences Bypass Matters

Chromium's Secure Preferences file uses HMAC-based integrity verification to prevent tampering with extension configuration. PEEP's installer forges these integrity values, meaning the browser accepts a sideloaded extension as legitimately installed without any user prompt or Web Store interaction. This is significant because many endpoint detection products monitor for extension installation via the standard Chrome/Edge installation paths — not for direct manipulation of preference files by a process already running on the host.

The lesson is clear: once an attacker has administrative or code execution access, browser-level trust models become irrelevant. The browser is not a security boundary when the host beneath it is compromised.

The Native Messaging Escalation

The most dangerous design choice in PEEP is its use of a native messaging host (nm_host.exe, registered under com.peep.lab). Native messaging is a legitimate Chromium feature that allows extensions to communicate with native OS binaries — typically used by password managers, screen recording tools, and enterprise agents. PEEP abuses this channel to:

Why the Secure Preferences Bypass Matters
Execute arbitrary shell commands from within the browser context
Manage files on the host filesystem
Enumerate running processes and services
Bridge browser-collected data (cookies, history, session tokens) with host-level exfiltration

This transforms PEEP from what would otherwise be a credential stealer into a functional remote access trojan that happens to live inside the browser process tree. Defenders who focus monitoring on standalone executables may miss this entirely, as malicious activity originates from the browser process itself.

Lineage and Attribution Signals

PEEP is a derivative of RedExt, an open-source browser data analysis and red teaming framework, and shares lineage with the previously reported GlassWorm attacks. The presence of Chinese-language artifacts in the source code suggests a Chinese-speaking developer, though SOCRadar has not formally attributed the activity. The C2 infrastructure (206.237.30.232 and xfjcc.fun) and the 30-second plaintext HTTP polling interval provide useful network detection signatures.

Key IOCs for Detection

  • Extension ID: ejkndncpkdcjcikfhiamcdehdoegilbj (masquerades as "Smart Bookmarks")
  • Native messaging host: nm_host.exe registered as com.peep.lab
  • C2 domains: xfjcc.fun, IP 206.237.30.232
  • C2 endpoints: /api/register, /api/commands
  • Protocol: Plaintext HTTP, 30-second polling interval

Shield53 Recommendations

Immediate Actions

  • Hunt for the extension: Search all endpoints for extension ID ejkndncpkdcjcikfhiamcdehdoegilbj in Chrome and Edge profile directories (~/AppData/Local/Google/Chrome/User Data/*/Extensions/ and equivalent Edge paths)
  • Audit native messaging hosts: Check Windows registry keys HKCU\Software\Google\Chrome\NativeMessagingHosts\* and HKLM\Software\Google\Chrome\NativeMessagingHosts\* for unexpected entries, particularly com.peep.lab
  • Block known C2: Add xfjcc.fun and 206.237.30.232 to network blocklists and DNS sinkholes; alert on any internal host communicating with these destinations
  • Enable extension blocklist enforcement: Deploy Chrome/Edge enterprise policies to restrict extension installation to an allowlist only (ExtensionInstallAllowlist / ExtensionInstallBlocklist)

Strategic Hardening

  • Monitor Secure Preferences integrity: Deploy file integrity monitoring (FIM) on Chromium profile preference files to detect tampering outside of normal browser operations
  • Inventory native messaging hosts enterprise-wide: Maintain a baseline of legitimate native messaging registrations and alert on any new, unapproved entries — this is a blind spot in many environments
  • Network egress controls: Browser processes making outbound HTTP (not HTTPS) connections on non-standard ports should trigger alerts, especially at regular intervals suggesting beaconing behavior
  • Post-compromise playbook revision: Update incident response procedures to include browser profile forensics — extension enumeration, native messaging host audit, and cookie/session token rotation — as standard steps after any host compromise

PEEP is a reminder that browsers are not just application targets — they are operating system intermediaries. An extension with native messaging access is functionally a userland agent with browser telemetry as a bonus. Defenders who treat browser extensions as low-risk productivity add-ons are leaving a significant attack surface unmonitored.