Cybersecurity experts have highlighted a sophisticated exploitation toolkit known as PEEP, which targets Chromium-based browsers like Chrome and Edge. This toolkit disguises itself as a browser bookmarks extension to facilitate post-compromise operations.
Details of the PEEP Toolkit
PEEP requires prior administrative access or code execution to operate. The installation process involves injecting the extension directly into browser profiles, circumventing web store validations and user prompts. This is achieved by manipulating Chromium’s Secure Preferences integrity checks. Additionally, a native-messaging client extends its capabilities beyond browser telemetry to enable host-level command execution and file handling.
Once the PEEP extension is in place, it communicates with its command-and-control (C2) server every 30 seconds over HTTP, retrieving commands and exfiltrating sensitive data such as browsing history and session cookies. It serves as a remote access and surveillance tool, executing host commands, capturing credentials, hijacking sessions, and modifying web pages.
Technical Aspects and Capabilities
Built on the RedExt framework, PEEP enhances this open-source toolkit with unique installation methods, a native host bridge, and an extended command set. This makes it a derivative of RedExt, previously associated with GlassWorm attacks. The extension, disguised as “Smart Bookmarks,” performs multiple functions, including polling for commands, harvesting browser data, and executing tasks.
The extension uses an auxiliary executable for system-level operations, while browser-specific commands are executed locally. The Native Messaging Host component transforms the malware from a simple credential stealer into a comprehensive remote-access tool. PEEP’s persistence is achieved through sideloading, enterprise policies, and preference manipulation.
Implications and Future Outlook
PEEP’s ability to modify Secure Preferences ensures it auto-activates when the browser starts. It leverages various installation policies and sideloading techniques due to its absence from official extension marketplaces. The malware employs PowerShell scripts to enable developer mode and manipulate Secure Preferences, indicating a potential threat to both Windows and Linux environments.
SOCRadar reports references to “Authorized CTF” use, suggesting the threat actor might exploit AI tools for malware development. Although the specific targets remain unknown, the threat is evident with numerous agent entries and active sessions recorded. PEEP functions by exploiting existing host vulnerabilities, transforming browsers into persistent backdoors for credential theft and command execution.
With its operation within the signed browser process, PEEP evades detection of unsigned binaries, positioning the browser as a pivotal tool for executing commands and stealing credentials. This highlights the ongoing need for enhanced cybersecurity measures to protect against such sophisticated threats.
