Loading today’s stories
Security1 publisher3 min readPublished
SOCRadar says the toolkit needs administrative or code execution access first, then writes itself into Chrome and Edge profiles with integrity values the browser accepts and bridges to a native host binary that runs shell commands.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
Chromium writes integrity values into the Secure Preferences file so it can tell whether an extension entry came from the browser or from something else on disk. PEEP's installer produces values that satisfy that check, which is how the extension lands in a Chrome or Edge profile with no Web Store listing and no user prompt [2]. A further edit to the same file sets the extension to auto-enable at browser launch [3].
Three PowerShell scripts carry the install. install_silent.ps1 turns on Developer Mode so arbitrary extensions can be sideloaded, and patch_secure_prefs.ps1 patches the integrity file [14]. force_enable.ps1 is the uninstall-resistance piece: it strips the extension from the external_uninstalls list in Preferences, drops the CRX at %LOCALAPPDATA%\PEEP\crx, re-registers it through the HKCU Extensions key and an External Extensions JSON manifest, then restarts the browser [15]. SOCRadar lists a ScriptCache fallback and enterprise force-install policy among the persistence paths as well [12]. Because PEEP is on no official marketplace, ExtensionInstallForcelist or ExtensionSettings do the delivery [13].
Inside the browser, the agent handles screenshots, clipboard reads and JavaScript injection on its own [10]. Anything requiring the operating system goes through com.peep.lab/nm_host.exe, which runs shell commands, manages files and enumerates processes and services in the user's context [9]. That binary, in SOCRadar's reading, is what moves the tool from credential stealer to remote-access tool [11], and the wider command set covers session hijacking and page modification [20].
The traffic is loud. The agent polls /api/commands every 30 seconds in plaintext HTTP to 206.237.30.232 or xfjcc.fun, sending browsing history, active-tab metadata and session cookies [5]. At that cadence one infected browser makes 2,880 poll requests a day [19], before registration, heartbeat, task-result and update calls, all on fixed paths [7]. The panel sits behind /login on port 5001, and /health answers without credentials [8].
The control that failed is not store review. PEEP has no initial access vector and assumes the operator already holds administrative or code execution access [1], and the store never sees a CRX written straight into a profile [2]. What breaks is inventory: the profile a management console reads back is the same file the operator edited [3]. The allowlisting mechanism doubles as the install mechanism once admin is in hand [13].
Lineage is public. PEEP is a derivative of RedExt, an open-source browser analysis and red teaming framework that also appeared in the GlassWorm attacks, extended with installation routines, a native host bridge, heartbeat telemetry and an update channel [17]. Attribution is not. SOCRadar says the activity is unattributed, with Chinese-language artifacts in the source code pointing to a Chinese-speaking actor [18]. The toolkit also ships patch_secure_prefs_linux.py, which indicates the same profile-tampering routine is being rebuilt for Linux [16]. The artifacts worth hunting are on disk and in the registry, and the beacon regularity in proxy logs.
Ranked by verification strength, evidence, and original report placement.
SOCRadar disclosed PEEP, a Chromium-based post-exploitation toolkit that masquerades as a bookmarks extension. It is described as a post-compromise framework because it lacks an initial access vector of its own and requires the operator to breach the machine by other means.
SOCRadar: "Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks and user prompts by forging Chromium's own Secure Preferences integrity values."
PEEP modifies the Secure Preferences file to ensure the extension is auto-enabled when the browser launches.
The extension masquerades as "Smart Bookmarks" with extension ID ejkndncpkdcjcikfhiamcdehdoegilbj, and is the main agent that executes the beacon loop by polling /api/commands.
The PEEP extension agent polls its command-and-control server at 206.237.30.232 or xfjcc.fun every 30 seconds over plaintext HTTP for new commands, while exfiltrating browsing history, active-tab metadata and session cookies.
SOCRadar: operating in the user context, the extension extracts browser artifacts and uses com.peep.lab/nm_host.exe to run shell commands, manage files, and discover processes and services. The extension invokes nm_host.exe when a task requires operating system access.
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
One lab, checkable artifacts
Extension ID, two C2 addresses, three PowerShell filenames, a CRX drop path, a registry key: the specificity is what earns the score, because any defender with browser-profile telemetry can go and look for these. The limit is that all of it traces to SOCRadar, quoted at length, with no second sighting of 206.237.30.232 and no browser-vendor comment on whether the Secure Preferences integrity value was ever expected to resist a local administrator.
34 entries on the attacker's own panel
Spread is measured, but by the operator. PEEP's unauthenticated /health page showed 34 agent entries, 10 active sessions and 507 data records when SOCRadar looked, and the report says plainly that real infections cannot be told apart from test hosts. No sector, region or named victim appears anywhere in this reporting, and the Linux capability is inferred from a script rather than from an observed infection.
Backdoor billing, admin prerequisite
SOCRadar's summary line — Chrome and Edge converted into a persistent backdoor — sits awkwardly beside the entry condition stated a few paragraphs above it, that administrative or code-execution access must already exist. What the Secure Preferences forgery actually buys is quiet persistence inside a signed process, which is interesting on its own terms and does not need the bigger billing. The Hacker News keeps the prerequisite visible and adds no drama of its own, so the stretch is modest and lives in the framing rather than the detail.
Vendor names its own find
The name, the analysis and every quoted line belong to one threat-intelligence firm, and the write-up is assembled from that report. Christening a malware family is how such firms show what their telemetry sees, and the closing quote doubles as an argument for watching the browser layer — the category SOCRadar sells into. That is a reason for care rather than dismissal: none of the artifacts is the sort a vendor gains from inventing, and every one of them is checkable by a third party who chooses to.
Solid detail, unconfirmed reach
The mechanics are specific enough to be falsified quickly if wrong, so the technical core will probably hold. Reach and origin are the soft parts: a count taken from the attacker's dashboard that the researchers decline to interpret, and a Chinese-language string as the only pointer to who is behind it. A corroborating report would move either judgement, but so far that report hasn't turned up for either one.
security
N-able Passportal leaked whole vaults to any page: v3.49.6 stops the leak, not the tokens1 publisher
build
height:auto is animatable now, so your max-height ceiling is a bug you can delete1 publisher
build
The stroke width that never rendered: SVG attributes lose every cascade fight1 publisher
build
Chrome's auto-update default distributed the drainer once the extension changed hands1 publisher
Publishers with included, body-backed reporting in this cluster.
1 article · September 7, 2026