PEEP Turns Chrome, Edge Into Post-Compromise Backdoors
A malicious Chrome or Edge extension called Smart Bookmarks lets attackers secretly run commands on your PC and steal your browsing data. It installs without warnings and communicates with a remote attacker every 30 seconds.
- Report priority
- Medium
- Targets
- Google Chrome+1 more
How it works
- Attackers install a fake Chrome or Edge extension called Smart Bookmarks (ID ejkndncpkdcjcikfhiamcdehdoegilbj) directly onto a user's browser without prompts.
- The extension bypasses normal security checks by modifying Chrome's internal settings.
- Once installed, it silently contacts a remote server every 30 seconds to receive commands and send stolen data, including browsing history, active tabs, and session cookies.
- It can also run commands on the user's PC and alter web pages.
What to do
Check if you have an extension named Smart Bookmarks (ID ejkndncpkdcjcikfhiamcdehdoegilbj) installed in Chrome or Edge. Open your browser's extensions page (chrome://extensions in Chrome, edge://extensions in Edge) and look for this extension. If it appears, remove it immediately. If you don't see it, you're not currently affected, but ensure no unauthorized extensions were installed on your system.
Remove the Smart Bookmarks extension right away if you find it. Go to chrome://extensions or edge://extensions, find the extension by its ID (ejkndncpkdcjcikfhiamcdehdoegilbj), and click Remove. Then, scan your system for any unauthorized changes or admin-level modifications. If you suspect unauthorized access, run a full antivirus scan and consider resetting your browser profiles to default. Check for any unusual network activity or unexpected connections to external servers.
Technical details
Affected software: Google Chrome, Microsoft Edge
An attacker with admin access to a PC installs the Smart Bookmarks extension onto Chrome or Edge by directly editing the browser's profile files. The extension then begins stealing browsing data and running commands on the system without the user noticing.
PEEP is a post-compromise malware framework that turns Google Chrome and Microsoft Edge into persistent backdoors by masquerading as a "Smart Bookmarks" extension (ID: ejkndncpkdcjcikfhiamcdehdoegilbj). Researchers at SOCRadar disclosed it as a Chromium-based toolkit that bypasses normal browser prompts by directly injecting itself into user profiles and manipulating Secure Preferences integrity checks. Unlike typical malicious extensions, PEEP requires prior code execution on the target machine and may need administrative privileges for persistence.
Once installed, PEEP steals browser data (history, active tabs, session cookies), hijacks authenticated sessions, and alters web pages. Its native messaging component (nm_host.exe) breaks the browser sandbox, allowing attackers to execute arbitrary commands, manage files, and enumerate system processes, effectively turning the browser into a conduit for deeper OS compromise. The extension communicates with command-and-control servers every 30 seconds over plaintext HTTP.
PEEP is derived from the open-source RedExt framework but adds its own persistence, telemetry, and expanded attack capabilities.