PEEP: A Post-Exploitation Toolkit That Weaponizes Chrome and Edge as Backdoors

Security researchers have disclosed a Chromium-based post-exploitation toolkit dubbed PEEP that disguises itself as a browser bookmarks extension while functioning as a backdoor for host command execution in Chrome and Edge.

What Was Reported

According to the disclosure, PEEP requires an attacker to already have administrative or code execution access on a host — it is not an initial-access technique. Once that access exists, PEEP's installer injects the malicious extension directly into Chrome or Edge browser profiles. It reportedly bypasses both Chrome Web Store review checks and normal user installation prompts by forging Chromium's own Secure Preferences file, which browsers normally use to detect and block unauthorized extension tampering.

Why It Matters for Defenders

PEEP represents a post-compromise persistence and command-execution mechanism, not a new exploit or initial-access vector. Its significance is that it repurposes a trusted, allow-listed application — the browser — as a covert channel for attacker control, which can blend into normal endpoint activity and evade tooling focused on unusual or unsigned binaries. Any organization where Chrome or Edge run with elevated or standard user privileges on endpoints is potentially affected once an attacker has a foothold.

What Defenders Should Watch For

• Monitor for unexpected modifications to browser profile files, particularly the Secure Preferences file, outside of normal browser update or extension-management workflows.
• Audit installed Chrome/Edge extensions across endpoints for entries not present in the Web Store or not pushed via managed enterprise policy, especially anything masquerading as a bookmarks or utility extension.
• Review endpoint logs for processes writing to browser profile directories shortly after other signs of administrative or code-execution compromise (e.g., following a separate initial-access or privilege-escalation event).
• Enforce browser extension allow-listing via enterprise policy (e.g., Chrome/Edge managed extension controls) to reduce the attack surface for unauthorized extension injection.
• Treat unexpected browser extension changes as a potential indicator of prior compromise rather than an isolated browser issue, and investigate for broader host access.

This is developing intelligence based on a single vendor disclosure, and technical details such as specific file paths, indicators of compromise, or attribution were not fully specified in the available reporting. Defenders should treat the above as directional hunting guidance and follow the original coverage for updates: The Hacker News.