PEEP Browser RAT Turns Chromium Extensions Into Host-Level Backdoors

Cybersecurity researchers at SOCRadar have uncovered PEEP, a modular browser-based Remote Access Trojan (RAT) that transforms Google Chrome and Microsoft Edge into durable entry points for full system compromise. Disguised as a "Smart Bookmarks" extension, the toolkit allows attackers to pivot from the browser to the host operating system to steal data and execute arbitrary commands.

To function, PEEP requires the attacker to already possess administrative privileges or code execution access on the target machine. Once installed, the toolkit bypasses Chromium's "Secure Preferences" by recalculating HMAC-SHA256 values and the "super_mac" using the browser's public canonical seed. This technical maneuver allows the malware to sideload the malicious extension silently, completely bypassing the standard security checks typically enforced by the Chrome Web Store.

Sandbox Escape and Execution

The toolkit's primary power lies in its ability to break out of the browser's restricted environment. PEEP utilizes a native-messaging bridge, identified as `com.peep.lab`, paired with a companion binary named `nm_host.exe`. This bridge enables the extension to escape the browser sandbox and interact directly with the host OS. Through this channel, attackers can execute shell commands, read and write local files, and enumerate active system processes.

To ensure it remains active, PEEP employs a four-layer persistence strategy. This includes the use of forged preferences, enterprise force-install policies, and external sideloading. Most notably, it utilizes a "Ghost Anchor" ScriptCache fallback, which allows malicious service workers to reload automatically even after the original source files have been deleted from the system.

Infrastructure and Origins

Analysis reveals that PEEP is derived from RedExt, an open-source command-and-control (C2) framework originally intended for authorized red-team operations. The malware communicates with a C2 panel built on Flask and SQLite via unencrypted HTTP. Researchers traced the infrastructure to a hardcoded IP address (206.237.30.232) hosted by Cloudie Limited in Hong Kong. Upon investigation, an exposed directory on port 5002 was discovered, containing the toolkit's source code and private signing keys.

Why It Matters

PEEP represents a significant shift in post-exploitation tactics. Traditionally, browsers have been targets for credential theft or phishing; however, PEEP demonstrates that the browser can serve as a durable pivot point for total host compromise. By subverting the browser's own integrity mechanisms and utilizing native messaging, the toolkit blends its activity into trusted browser processes. This makes detection exceptionally difficult for traditional security tools that do not specifically monitor the bridge between the browser and the operating system.

What's Next

As SOCRadar noted via GBHackers, "PEEP shows how browser extensions can become a durable post-compromise foothold." Security teams should now prioritize the monitoring of native messaging hosts and unexpected changes to browser preference files. Further investigation into the leaked signing keys may reveal whether other variants of this toolkit are currently active in the wild.