PEEP toolkit hijacks Chrome and Edge to run OS commands from inside the browser

Security researchers at SOCRadar disclosed on September 7 a sophisticated post-exploitation toolkit called PEEP that transforms Google Chrome and Microsoft Edge into persistent backdoors capable of executing operating-system commands from within the browser process. The malware masquerades as a browser extension named "Smart Bookmarks" and requires an attacker to already have administrative or code-execution access to a victim's machine before deployment.

Once installed, PEEP injects a malicious extension into browser profiles by forging Chromium's Secure Preferences integrity files — the internal safety check that is supposed to flag tampered extensions. The installer deploys a chain of PowerShell scripts (install_silent.ps1, patch_secure_prefs.ps1, force_enable.ps1) and abuses Windows Group Policy's ExtensionInstallForcelist setting to ensure the extension loads on every browser start.

Because PEEP runs entirely within the signed Chrome or Edge process, conventional signature-based endpoint detection largely ignores it. From inside the browser, the extension provides attackers with a persistent foothold that survives reboots and browser updates: it can extract browsing history, active-tab content, and session cookies; execute arbitrary commands on the host operating system; modify web-page content in real time; and perform file management and process discovery.

Command-and-control communication runs over plaintext HTTP, polling the attacker's servers every 30 seconds at endpoints such as 206.237.30[.]232 and xfjcc[.]fun. Chinese-language strings scattered through the code suggest the authors are Chinese-speaking, though SOCRadar stopped short of attributing PEEP to a known threat group.

No CVE has been assigned — PEEP exploits no browser vulnerability per se, but rather abuses legitimate browser extension APIs and Group Policy features that any software with local admin rights can reach. Google and Microsoft have not issued guidance specific to PEEP, though enterprise teams can limit exposure by enforcing strict extension allow-lists through policy and monitoring for unexpected entries in the ExtensionInstallForcelist registry key. Blocking outbound HTTP to unknown hosts at the perimeter would also interrupt PEEP's C2 channel.

PEEP is the latest in a line of post-exploitation tools that target the browser as a privileged attack surface. Because browsers hold authenticated sessions to cloud services, banking portals, and corporate SaaS tools, a persistent browser backdoor can be more valuable than a traditional reverse shell — especially in enterprises that rely on Chrome or Edge for SSO. Security teams should treat any unexpected browser extension on corporate devices as a potential indicator of compromise and investigate the full local admin trail that preceded it.

As first reported by The Hacker News, citing SOCRadar research published September 7, 2026.