{"id":1467,"date":"2026-09-08T13:42:04","date_gmt":"2026-09-08T08:12:04","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1467"},"modified":"2026-09-09T14:35:30","modified_gmt":"2026-09-09T09:05:30","slug":"peep-malware-chrome-edge-backdoor","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/peep-malware-chrome-edge-backdoor\/","title":{"rendered":"PEEP Malware Turns Chrome and Edge Into Post-Compromise Backdoors"},"content":{"rendered":"

A malicious browser extension does not always need to begin with a deceptive Web Store installation. PEEP malware demonstrates what attackers could do after they already control an endpoint.<\/p>\n

SOCRadar’s Threat Research Unit identified PEEP as a Chromium-based post-exploitation toolkit disguised as a \u201cSmart Bookmarks\u201d extension. The recovered toolkit requires prior administrative or code-execution access. Therefore, PEEP is not an initial-access exploit or browser vulnerability.<\/p>\n

Instead, its distinctive technique starts after endpoint compromise. PEEP manipulates Chromium’s Secure Preferences integrity values to help install and retain a sideloaded extension. It then connects the extension to a native messaging host for operating-system access. The recovered host-side binary, nm_host.exe<\/code>, targets Windows.<\/p>\n

PEEP Malware at a Glance<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Detail<\/span><\/b>\u00a0<\/span><\/td>\nInformation<\/span><\/b>\u00a0<\/span><\/td>\n<\/tr>\n
Threat<\/span>\u00a0<\/span><\/td>\nPEEP<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Type<\/span>\u00a0<\/span><\/td>\nChromium-based post-exploitation toolkit<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Disguise<\/span>\u00a0<\/span><\/td>\n\u201cSmart Bookmarks\u201d extension<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Browsers<\/span>\u00a0<\/span><\/td>\nGoogle Chrome and Microsoft Edge<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Recovered host platform<\/span>\u00a0<\/span><\/td>\nWindows<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Initial access<\/span>\u00a0<\/span><\/td>\nPrior administrative or code-execution access\u00a0required<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Host bridge<\/span>\u00a0<\/span><\/td>\ncom.peep.lab<\/code>\u00a0\/ nm_host.exe<\/code><\/span>\u00a0<\/span><\/td>\n<\/tr>\n
C2 communication<\/span>\u00a0<\/span><\/td>\nPlaintext HTTP<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Polling interval<\/span>\u00a0<\/span><\/td>\nNominally every 30 seconds<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Confirmed victim deployment<\/span>\u00a0<\/span><\/td>\nNot\u00a0established\u00a0by available research<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

SOCRadar also describes PEEP as derived from the open-source RedExt framework rather than an entirely independent codebase.<\/p>\n

How PEEP Malware Manipulates Chromium Secure Preferences<\/h2>\n

PEEP’s defining behavior is how it turns an existing endpoint compromise into persistent browser-level access.<\/p>\n

Its installation routines can inject the extension into Chrome and Edge profiles. One installer, install_silent.ps1<\/code>, works with patch_secure_prefs.ps1<\/code> to manipulate Chromium’s Secure Preferences data. The toolkit recalculates integrity values associated with the modified preferences so the browser accepts the changes.<\/p>\n

PEEP uses layered persistence through validated Secure Preferences state, enterprise force-install policies, a registered native-messaging host and a Ghost Anchor ScriptCache fallback.<\/p>\n

That enterprise-policy abuse matters because force installation itself is legitimate Chromium functionality. Google’s documentation states that ExtensionInstallForcelist<\/code><\/a> can silently install specified extensions and prevent users from disabling or removing them. PEEP demonstrates how legitimate browser administration mechanisms can become useful after an attacker already controls the endpoint.<\/p>\n

How nm_host.exe Takes PEEP Beyond the Browser<\/h2>\n

PEEP does not stop at browser surveillance.<\/p>\n

The extension communicates with a native messaging host named com.peep.lab<\/code>. Its recovered Windows implementation uses nm_host.exe<\/code> to bridge browser activity with operating-system functionality.<\/p>\n

Native messaging is another legitimate browser capability. Chrome permits extensions to exchange messages with registered native applications. On Windows, defenders should also inspect the registry locations used to register PEEP’s native messaging host. These include HKLM\\SOFTWARE\\Google\\Chrome\\NativeMessagingHosts\\com.peep.lab<\/code> and HKCU\\Software\\Google\\Chrome\\NativeMessagingHosts\\com.peep.lab<\/code>, along with corresponding Edge and WOW6432Node<\/code> locations. These artifacts can help SOC teams identify the browser-to-host bridge during endpoint investigations.<\/p>\n

PEEP abuses that browser-to-host bridge for capabilities including:<\/p>\n