PEEP: The Fake Bookmarks Extension That Turns Chrome Into a Backdoor
Researchers have detailed a post-exploitation toolkit that quietly slips into Chrome and Edge profiles by faking the browser's own trust files.
Key points
- Researchers have disclosed a post-exploitation toolkit tracked as PEEP that hides inside Chromium-based browsers as a fake bookmarks extension.
- PEEP needs an attacker to already hold administrator or code execution rights on the machine before it can be installed.
- The installer forges Chromium's Secure Preferences file, bypassing Chrome Web Store checks and the usual user approval prompt.
- Once loaded, the extension runs inside Chrome and Microsoft Edge profiles and can be used to run commands on the host.
- The toolkit is a post-compromise capability, meaning it extends access an intruder already has rather than opening the door in the first place.
Security researchers have detailed a stealthy attacker toolkit called PEEP that turns Google Chrome and Microsoft Edge into quiet backdoors on machines an intruder has already broken into.
The tool disguises itself as a browser extension for managing bookmarks. In reality, it gives an attacker a way to run commands on the victim's computer through the browser they use every day.
PEEP was described in reporting from The Hacker News, drawing on the researchers' technical writeup.
What is PEEP, in plain English?
PEEP is a post-exploitation toolkit, meaning a piece of software attackers install after they have already gained a foothold on a computer. Think of it as furniture an intruder moves in once they have picked the lock. It does not get them through the door.
Once inside, PEEP hides as a browser extension. Extensions are the small add-ons people install to block ads, save passwords, or manage bookmarks. Because browsers are almost always running, an extension is a convenient place for an attacker to sit and take orders.
How does it get into the browser?
It cheats the trust system Chromium uses to decide which extensions are allowed to run. Normally, installing a Chrome or Edge extension means going through the official Chrome Web Store and clicking a confirmation prompt. PEEP skips both.
The installer needs to already have administrator rights or the ability to run code on the machine. That is a high bar, but a routine one for attackers who have used phishing, where criminals send fake emails to trick staff into handing over passwords or running attachments, to land on a laptop.
With those rights, the installer edits a file Chromium keeps on disk called Secure Preferences. This file records which extensions the browser trusts. PEEP forges the cryptographic signature Chromium uses to protect that file, so the browser sees the fake bookmarks extension as legitimate on next launch. No Web Store check. No user prompt. No warning.
Which browsers are affected?
Any Chromium-based browser that uses the Secure Preferences design is in scope. That includes Google Chrome and Microsoft Edge, the two browsers named by the researchers, and in principle other Chromium forks that share the same profile format.
| Detail | What researchers describe |
|---|---|
| Toolkit name | PEEP |
| Disguise | Bookmarks manager extension |
| Target browsers | Google Chrome, Microsoft Edge |
| Access needed | Administrator or code execution on the host |
| Bypass technique | Forged Chromium Secure Preferences file |
| Stage of attack | Post-exploitation (after initial break-in) |
Should ordinary users be worried?
Not in the way a phishing email or a fake login page should worry you. PEEP is not something you catch by clicking a bad link on its own. An attacker has to already control your machine at a deep level before they can plant it.
The worry sits with IT and security teams. A malicious extension installed this way will not show up in the usual "was this from the Web Store?" checks, and it survives across browser sessions. If defenders are only watching the Web Store install path, PEEP walks around them.
What the disclosure tells defenders
Distinguish capability from intent here. The researchers describe a capability: a clean way to persist inside a browser after a break-in. They have not tied PEEP, at this stage, to a specific named cluster such as Kimsuky or Mustang Panda. Treat any attribution claims that appear later with the usual caution, and look for corroborating infrastructure or code overlaps before believing them.
For blue teams, the practical signal is file integrity monitoring on Chromium's Secure Preferences and the extensions directory, plus alerting on new extensions that did not arrive through the managed install path.
