PEEP: The Fake Bookmarks Extension That Turns Chrome Into a Backdoor
Researchers have detailed a post-exploitation toolkit that quietly slips into Chrome and Edge profiles by forging the browser's own trust files.
Key points
- Researchers have disclosed a post-exploitation toolkit tracked as PEEP that hides inside Chromium-based browsers as a fake bookmarks extension.
- PEEP needs an attacker to already hold administrator or code execution rights on the machine before it can be installed.
- The installer forges Chromium's Secure Preferences file, bypassing Chrome Web Store checks and the usual user approval prompt.
- Once loaded, the extension runs inside Chrome and Microsoft Edge profiles and can be used to run commands on the host.
- The toolkit is a post-compromise capability, meaning it extends access an intruder already has rather than opening the door in the first place.
Security researchers have detailed a stealthy attacker toolkit called PEEP that turns Google Chrome and Microsoft Edge into quiet backdoors on machines an intruder has already broken into. The tool disguises itself as a browser extension for managing bookmarks and, once planted, gives an attacker a way to run commands on the victim's computer through the browser they use every day.
What is PEEP, in plain English?
PEEP is a post-exploitation toolkit: software attackers install after they've already gained a foothold on a computer. Think of it as furniture an intruder moves in once they've picked the lock. It doesn't get them through the door.
Once inside, PEEP hides as a browser extension. Because browsers are almost always running, an extension is a convenient place for an attacker to sit and take orders.
How does it get into the browser?
It cheats the trust system Chromium uses to decide which extensions are allowed to run. The installer needs administrator rights or the ability to run code on the machine first. That's a high bar, but a routine one for attackers who've used phishing to land on a laptop.
With those rights, the installer edits a file Chromium keeps on disk called Secure Preferences, which records which extensions the browser trusts. PEEP forges the cryptographic signature Chromium uses to protect that file, so the browser sees the fake bookmarks extension as legitimate on next launch. No Web Store check, no user prompt, no warning banner.
This sits in a pattern we've been tracking across Chromium-based browsers. Our 17 August story covered a technique that flips on Chrome's built-in debugger to steal cookies from a live session without touching the password vault. PEEP is a different mechanism but the same post-compromise instinct: stay inside the browser because defenders often aren't watching there.
Which browsers are affected?
Any Chromium-based browser that uses the Secure Preferences design is in scope. That includes Google Chrome and Microsoft Edge, the two browsers named by the researchers, and in principle other Chromium forks that share the same profile format.
| Detail | What researchers describe |
|---|---|
| Toolkit name | PEEP |
| Disguise | Bookmarks manager extension |
| Target browsers | Google Chrome, Microsoft Edge |
| Access needed | Administrator or code execution on the host |
| Bypass technique | Forged Chromium Secure Preferences file |
| Stage of attack | Post-exploitation (after initial break-in) |
Should ordinary users be worried?
Not in the way a phishing email should. PEEP isn't something you catch by clicking a bad link on its own. An attacker has to already control your machine at a deep level before they can plant it.
The worry sits with IT and security teams. A malicious extension installed this way won't show up in the usual Web Store checks, and it survives across browser sessions. If defenders are only watching the Web Store install path, PEEP walks around them.
What the disclosure tells defenders
Distinguish capability from intent here. The researchers describe a capability: a clean way to persist inside a browser after a break-in. They haven't tied PEEP, at this stage, to a specific named cluster such as Kimsuky or Mustang Panda. Treat any attribution claims that appear later with the usual caution, and look for corroborating infrastructure or code overlaps before believing them.
For blue teams, the practical signal is file integrity monitoring on Chromium's Secure Preferences and the extensions directory, plus alerting on new extensions that didn't arrive through the managed install path. The browser is not a safe harbour.
