PEEP: A Browser RAT Posing as a Chrome Extension
PEEP is a malicious Chrome extension called Smart Bookmarks that secretly turns your browser into a remote control tool. Once installed, it steals browsing data, session cookies, and can even run commands on your computer without your knowledge.
- Report priority
- High
- Targets
- Chrome
How it works
- An attacker sends you a fake Chrome extension called Smart Bookmarks.
- If you install it, it tricks Chrome into thinking it's official by faking security checks.
- The extension then secretly runs in your browser, stealing your browsing history, cookies, and active tabs.
- It also uses a hidden bridge to run commands on your computer and manage files, all while sending data back to the attacker every 30 seconds over an unencrypted connection.
What to do
Check if you have an unknown extension named Smart Bookmarks installed in Chrome or Edge. Go to your browser's extensions page (chrome://extensions in Chrome) and look for any suspicious or unfamiliar extensions. If you see Smart Bookmarks or any other unknown extension, remove it immediately.
Remove the Smart Bookmarks extension right away if you see it. Then, scan your computer for any malicious software using your antivirus or security software. If you suspect your computer has been compromised, reset your passwords for all accounts accessed via Chrome and monitor your accounts for unusual activity.
Technical details
An attacker sends a fake Chrome extension called Smart Bookmarks to a victim. The victim installs it, believing it's legitimate. The extension then steals browsing data, session cookies, and gains control over the victim's computer by bypassing Chrome's security checks.
A new post-exploitation toolkit called PEEP disguises itself as a Chrome extension named "Smart Bookmarks" to bypass security checks and inject malicious code into Chromium-based browsers (Chrome, Edge). Requiring prior administrative or code execution access, PEEP manipulates Chrome's Secure Preferences integrity values to sideload the extension without user prompts or Web Store validation. Once installed, it uses a native-messaging bridge to escalate from browser-level access to full host control, enabling command execution, file management, and process discovery.
PEEP exfiltrates browsing history, active-tab metadata, session cookies, and executes broader host-level commands over plaintext HTTP every 30 seconds. Built on the RedExt framework, it extends functionality with persistence mechanisms, a heartbeat beacon, and an expanded command set. The toolkit leverages the browser's signed process to evade detection, turning Chrome/Edge into a persistent backdoor for credential theft, session hijacking, and arbitrary command execution.
An exposed open repository (port 5002) revealed source code, builds, logs, and the extension's private key.