PEEP: A Browser RAT Posing as a Chrome Extension
A fake Chrome extension called Smart Bookmarks secretly turns your browser into a spy tool. It steals passwords, browsing history, and session data, then sends it to attackers every 30 seconds.
- Report priority
- High
- Targets
- session hijacking+3 more
How it works
- An attacker installs a fake Chrome extension called Smart Bookmarks.
- It tricks Chrome into thinking it's official by faking security checks.
- The extension then secretly runs commands on your computer, steals your browsing history, passwords, and session data, and sends it to attackers every 30 seconds over an unsecured connection.
What to do
Check if you have an extension called Smart Bookmarks installed in Chrome or Edge. Open your browser's extensions page (chrome://extensions in Chrome, edge://extensions in Edge) and look for it. If you see it, remove it immediately. If you didn't install it yourself, remove the Smart Bookmarks extension right away.
Then, check your browsing history and passwords for any unusual activity. If you suspect your computer has been infected, run a full antivirus scan and consider resetting your browser settings to default. If you installed it from a trusted source, contact them to report the fake extension.
Technical details
Affected software: session hijacking, native messaging, browser extension, post-exploitation
An attacker sends a fake Chrome extension called Smart Bookmarks to a victim. The victim installs it, thinking it's a legitimate tool. The extension then starts stealing data and sending it to the attacker's servers every 30 seconds.
PEEP is a Chromium-based remote access trojan (RAT) masquerading as a legitimate Chrome extension called "Smart Bookmarks." It requires local administrative privileges to bypass Chrome Web Store security by forging Chromium integrity checks, then establishes persistent backdoors in Chrome and Edge browsers. Using native messaging, the malware escalates from browser telemetry to full host-level command execution, allowing attackers to execute arbitrary shell commands, manipulate files, and discover running processes. The tool exfiltrates sensitive data, including browsing history, cookies, credentials, and session data, via unencrypted HTTP every 30 seconds.
Built on the RedExt framework with custom enhancements, PEEP combines browser surveillance with advanced persistence mechanisms like HMAC forgery, enterprise policy manipulation, and ScriptCache abuse. Exposed development artifacts suggest a Chinese-speaking operator using AI-assisted tooling, with source code, signing keys, and test logs in Traditional Chinese. The threat actor leverages persistent beaconing and elevated privileges to maintain long-term access.