‘PEEP’ Tool Turns Chrome and Edge Into Post‑Compromise Backdoors Through Malicious Extension
A toolset described by security researchers as PEEP can abuse a Chrome and Edge extension called Smart Bookmarks, stealing session cookies and credentials and then issuing commands on the host via Chromium native messaging. The technique turns everyday browsers into host‑level backdoors once attackers already have access to a machine.
Security researchers say a toolset known as PEEP can turn widely used web browsers into powerful post‑compromise backdoors.
According to a technical report, PEEP abuses the Smart Bookmarks extension in Google Chrome and Microsoft Edge after an attacker already has administrator or code‑execution access to a device. With that level of access in place, the extension can be used to steal session cookies and credentials from the browser.
The same analysis explains that PEEP then relies on Chromium native messaging — a legitimate feature that lets browser extensions talk to helper programs on the operating system — to run commands on the host machine. In practice, this means a compromised browser can become a channel for executing system‑level actions.
This design makes PEEP a post‑compromise tool: it does not provide the initial break‑in, but it deepens the attacker’s control once they are inside a network. A single breached workstation with Chrome or Edge can be turned into a control point for further activity.
For individual users, stolen cookies and credentials can enable account takeover on online services that rely on browser sessions. For organizations, a compromised browser profile can expose internal applications, cloud dashboards, and email accounts tied to that user.
Because native messaging traffic looks like normal interaction between a browser and a local helper process, security tools focused on traditional malware signatures or external network traffic may find it harder to spot.
Strategically, PEEP underscores how everyday software such as web browsers can be repurposed into attack infrastructure once an intruder gains local access.
Signals to watch include whether browser vendors adjust native messaging controls or extension review processes, and how quickly endpoint security products begin detecting Smart Bookmarks‑style abuse patterns associated with PEEP.
Sources
- OSINT