PEEP, a malicious Chrome extension posing as Smart Bookmarks, can steal active login sessions and turn an already compromised Windows computer into a remote backdoor.

The finding shows how a browser add-on can become far more dangerous than a simple data thief when it gains a path to the operating system.

The toolkit does not appear to provide its own way into a device. Instead, attackers need prior code execution or administrative access, then silently place it in Chrome or Edge profiles.

Its installers can alter browser settings so the extension launches without the usual store checks, approval prompts, or visible warnings.

Analysts at SOCRadar identified the operation as PEEP, a Chromium-based post-compromise toolkit derived from the open-source RedExt project.

SOCRadar said in a report shared with Cyber Security News (CSN) that the researchers found a primary build disguised as Smart Bookmarks, version 1.3.0, along with a related testing variant and an exposed development repository.

Architecture Overview (Source - SOCRadar) — Architecture Overview (Source – SOCRadar)

The scale of confirmed victim impact remains unclear. A server status snapshot recorded 34 agent entries, 10 active sessions, and 507 data records, but test identifiers mean those figures cannot prove the number of infected devices.

Still, the design creates a serious risk because stolen session cookies may let an intruder enter accounts without needing a password again.

Malicious Chrome Extension

Once active, PEEP runs inside the browser and asks for broad access to tabs, cookies, history, bookmarks, downloads, browser settings, scripting, and every website.

It gathers browsing history, open-tab details, session cookies, form data, clipboard contents, screenshots, and local or session storage, creating a broad view of a victim’s online activity.

The session-theft capability is especially concerning because a valid cookie proves that a user has already signed in.

C2 Login Panel (Source - SOCRadar) — C2 Login Panel (Source – SOCRadar)

As explained in this guide to stolen browser cookie risks, an attacker who obtains that token may be able to reuse an active session and sidestep a later password or MFA prompt until the session is revoked.

PEEP also accepts commands to open pages, inject JavaScript, change proxy settings, and capture page content. It contacts its command server at regular intervals using unencrypted HTTP, allowing the operator to send tasks and receive collected data.

That behavior resembles other malicious browser add-on campaigns that abuse extensions to monitor sensitive activity.

The native-messaging bridge is what changes the threat from browser monitoring into host control. The browser extension can call a companion Windows program, enabling shell commands, file operations, and discovery of running processes and services under the current user account.

Persistence Raises Cleanup Challenge

PEEP uses several methods to remain in place after installation. Its scripts can forge Chrome Secure Preferences integrity values, use enterprise force-install policies, or sideload the extension.

It can also exploit a ScriptCache fallback, leaving apparently harmless source files while Chrome reloads a previously compiled malicious service worker.

That layered approach means removing the visible extension alone may not be enough. Security teams should identify the listed extension IDs, remove the associated native-messaging host and local artifacts, and review browser policies and registry entries.

PEEP attack lifecycle (Source - SOCRadar) — PEEP attack lifecycle (Source – SOCRadar)

The finding follows earlier cases in which a native messaging host backdoor turned Chrome into a route for device-level control.

Organizations should block the identified infrastructure, restrict traffic to the exposed services, and investigate browser processes or PowerShell activity that modifies Secure Preferences files.

Strict extension allow-lists, disabled developer mode, restrictions on external sideloading, and approval of only trusted native-messaging hosts can reduce the chance of a similar installation succeeding.

Defenders should also treat a suspected PEEP infection as both an endpoint and identity incident. Remove the malware, end active sessions, rotate affected credentials, and examine account activity for misuse.

Phishing-resistant MFA and browser protections for stored credentials add useful friction, while the recent Chrome extension supply chain attacks show why every installed add-on deserves careful ongoing review.

Indicators of compromise (IoCs):-

Type	Indicator	Description
C2 host	`206.237.30.232`	Hardcoded command-and-control, payload distribution, and staging host
Domain	`xfjcc.fun`	Reported C2 domain
Domain	`new.xfjcc.fun`	Reported C2-related subdomain
Domain	`newadmin.xfjcc.fun`	Reported C2-related subdomain
Domain	`newapi.xfjcc.fun`	Reported C2-related subdomain
C2 service	`tcp/5001`	C2 control panel and agent API service
Staging service	`tcp/5002`	Exposed development and payload-staging repository
C2 endpoint	`/api/register`	Agent registration endpoint
C2 endpoint	`/api/commands?agent_id=`	Command polling endpoint
C2 endpoint	`/api/exfil`	Data-exfiltration endpoint
C2 endpoint	`/api/agents/`	Agent heartbeat endpoint
C2 endpoint	`/api/agents/`	Task-result endpoint
C2 endpoint	`/api/agents/`	Observed candidate alternate data channel
C2 endpoint	`/api/extension_update/`	Extension update endpoint
C2 endpoint	`/api/extension_crx/`	Extension delivery endpoint
C2 endpoint	`/health`	Unauthenticated server status endpoint
HTTP header	`X-PEEP-Agent-Key`	Agent identification header
HTTP header	`X-PEEP-Agent-Id`	Agent identification header
HTTP authentication realm	`realm="PEEP"`	Control-panel HTTP Basic authentication realm
Extension ID	`ejkndncpkdcjcikfhiamcdehdoegilbj`	Primary Smart Bookmarks payload
Extension ID	`bibjjhidpdmfcbkodddndmoejcloobdh`	Alternate smoke-agent variant
Extension ID	`hpjgilbbdmfcnaapjbofmmmjjfijbdki`	Reported related extension identifier
Extension ID	`akhljhifabhkcoboncoiekfpdodjaack`	Reported related extension identifier
Extension ID	`eljagiodakpnjbaceijefgmidmpmfimg`	Reported related extension identifier
Native-messaging host	`com.peep.lab`	Native host registered for browser-to-host communication
File	`nm_host.exe`	Windows native-messaging host binary
File	`nm_host.js`	Native-host script
File	`install_silent.ps1`	Silent installation script
File	`patch_secure_prefs.ps1`	Browser preference-forgery script
File	`force_enable.ps1`	Extension re-registration script
File	`patch_secure_prefs_linux.py`	Linux preference-forgery script
File	`extension.pem`	Extension signing private key included in recovered packages
File	`CHROME150-LIVE-RESULT.md`	Development and testing log
File	`background.js`	Extension service-worker script
File	`content.js`	Extension content script
Static key	`peep_nm_host_aes256_key_32bytes!`	Embedded native-host encryption key
Local path	`%LOCALAPPDATA%\PEEP`	Local staging and artifact directory
Registry path	`HKCU/HKLM\...\NativeMessagingHosts\com.peep.lab`	Native-messaging host registration location
File pattern	`.bak_peep_hmac_`	Backup artifact associated with preference modification
File pattern	`.bak_peep_enable_`	Backup artifact associated with extension enabling
Distinctive string	`Smart Bookmarks`	Malicious extension display name
Distinctive string	`PEEP Client`	Internal toolkit name
Distinctive string	`AI · 法客-P`	C2-panel string
Distinctive string	`redext-compatible`	Framework-related identifier
Agent key	`a6dfab5a6e510ece`	Reported embedded agent key
Agent key	`348e99545a69b184`	Reported embedded agent key
SHA-256	`86a5fb2f14d175d1c13a7b49b55b968b2a5e96afc944d85a31b3`	Reported PEEP-related hash value
SHA-256	`6700e30a3224248085d30f2eb727cea28dec288355fca675344`	Reported PEEP-related hash value
SHA-256	`9402c0198ae5c8bed14cdeaabe7e8b25625debbc62a900cfcdb`	Reported PEEP-related hash value
SHA-256	`8edd653910f3217c96a603e8ce9e5e409d3b8674476f22e0a3a`	Reported PEEP-related hash value
SHA-256	`87db7138a80117ddf2989827c1dde09ee73c7a252d511c74ed66`	Reported PEEP-related hash value
SHA-256	`259d8eddb6caf509d7bffa2b4c0dd7d89668800c870f529729a`	Reported PEEP-related hash value
SHA-256	`e46aee4ca43ba66666f6572c62365cf57642f2cf1f6eca00fcf8e`	Reported PEEP-related hash value
SHA-256	`f031c00f592aa5e98893b4532f743362fed7fb0a485e8a3c0ad4`	Reported PEEP-related hash value
SHA-256	`a43bf7f81507c8f9d0942fed331e7590a43044a6d219ec100597`	Reported PEEP-related hash value
SHA-256	`b4e3ca8f44477b9ade1272f92516202f83a80219c8bd6176527a`	Reported PEEP-related hash value
SHA-256	`8e988b915b75dd749e3f4e1ca7ee21746885b4fe34e8a246e6f1`	Reported PEEP-related hash value
SHA-256	`9c6b269e5087a40b4552f72e9ff13d9b39e433af5075ad68f57e`	Reported PEEP-related hash value
SHA-256	`207e0d47c4e5493ef7313eb1faeb1c6195923c89f263e548609a`	Reported PEEP-related hash value

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Malicious Chrome Extension Can Steal Login Sessions and Turn PCs Into Remote Backdoors appeared first on Cyber Security News.