Affected Systems

Chrome and Edge browsers on Windows and Linux. PEEP is a post-exploitation toolkit requiring prior administrative or code execution access. It masquerades as "Smart Bookmarks" extension (ID: ejkndncpkdcjcikfhiamcdehdoegilbj) and uses native messaging host (nm_host.exe) for OS-level command execution.

Exploitation Status

Active campaign detected. C2 infrastructure operational at 206.237.30[.]232 and xfjcc[.]fun with 34 agent entries and 10 active sessions observed. PEEP is a derivative of open-source RedExt framework, previously used in GlassWorm attacks. Threat actor likely Chinese-speaking based on source code artifacts.

Business Impact

Organizations with compromised endpoints face persistent browser-based backdoors that bypass sandbox protections. PEEP exfiltrates browsing history, session cookies, credentials, and active-tab metadata every 30 seconds over plaintext HTTP. The toolkit enables remote command execution, file management, process discovery, JavaScript injection, and session hijacking. Because malicious logic runs inside signed browser processes, traditional detection focused on unsigned binaries may miss this threat. Requires prior breach for deployment, making this a second-stage persistence mechanism.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Hunt for extension ID ejkndncpkdcjcikfhiamcdehdoegilbj and nm_host.exe across Chrome/Edge browser profiles in user directories
  • Block C2 domains xfjcc[.]fun and IP 206.237.30[.]232 at network perimeter and DNS layers
  • Audit Chrome/Edge enterprise policies for unauthorized ExtensionInstallForcelist or ExtensionSettings entries that bypass Web Store validation
  • Monitor Secure Preferences file modifications and external extension sideloading in %LOCALAPPDATA%\PEEP\crx and HKCU\Software\Google\Chrome\Extensions registry keys
  • Review EDR logs for PowerShell scripts modifying browser preferences (install_silent.ps1, patch_secure_prefs.ps1, force_enable.ps1) and Python scripts on Linux (patch_secure_prefs_linux.py)
  • Inspect outbound HTTP traffic to /api/commands, /api/register, /api/heartbeat, and /api/exfil endpoints for beacon patterns with 30-second intervals