Cybersecurity experts have recently exposed a sophisticated Chromium-based post-exploitation toolkit known as PEEP, posing as a bookmarks extension for web browsers.
Requiring prior administrative or code execution access, PEEP’s installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks and user prompts by falsifying Chromium’s Secure Preferences integrity values. A native-messaging tool further expands its capabilities to include host-level command execution and file management.
This malicious extension, disguised as “Smart Bookmarks,” operates as a remote access and browser monitoring tool, capable of running host commands, stealing credentials, hijacking sessions, and modifying web pages. It communicates with its command-and-control server every 30 seconds to receive new instructions and exfiltrate sensitive data such as browsing history, active tab details, and session cookies.
Built upon the foundations of the RedExt framework, PEEP enhances the toolkit with additional features like dedicated installation routines, a native host bridge, heartbeat telemetry, and an extended command set. This evolution makes PEEP a derivative of RedExt, previously utilized in GlassWorm attacks.
PEEP is classified as a post-compromise framework, requiring a prior breach to deploy the malware. While the threat actor behind PEEP remains unidentified, Chinese-language artifacts in the source code suggest a Chinese-speaking origin.
To ensure persistence, PEEP modifies the Secure Preferences file to automatically enable the extension upon browser launch. Leveraging sideloading techniques and PowerShell scripts, PEEP evades detection and delivers its payload efficiently. Additionally, Python scripts indicate the threat actor’s intent to target Linux environments as well.
The extension communicates with various endpoints to register infections, receive tasking, update itself, and post results of command executions. By running inside the signed browser process, PEEP evades detection and acts as a persistent backdoor for credential theft, session manipulation, and command execution.
In conclusion, PEEP represents a dangerous evolution in browser-based malware, highlighting the importance of robust cybersecurity measures to combat evolving threats.
