PEEP Chromium Post-Exploitation Backdoor Toolkit
First seen Sep 8, 2026 · Updated Sep 8, 2026
PEEP is a post-compromise toolkit that disguises itself as a bookmarks extension for Chrome and Edge, requiring prior administrative or code execution access to deploy. It forges Chromium's Secure Preferences file to bypass Web Store validation and user consent prompts, effectively turning the browser into a persistent backdoor capable of executing host commands.
Technical Analysis
PEEP operates as a second-stage implant, meaning it does not provide initial access but instead entrenches attacker control after a system is already compromised via admin credentials or arbitrary code execution. The installer manipulates the Secure Preferences JSON file and its integrity hash (HMAC validation) to sideload a malicious unpacked extension into Chrome/Edge browser profiles without triggering Chromium's extension policy warnings. Once installed, the extension acts as a command-and-control channel, allowing operators to issue host-level commands through the browser process, blending malicious traffic with legitimate browser network activity and evading many endpoint detection tools that whitelist browser processes. This technique is particularly concerning for AI agent systems: browser-based AI agents, RPA tools, and LLM-driven browser automation frameworks that operate through Chrome/Edge profiles could have their sessions hijacked, cookies/API tokens exfiltrated, or be coerced into executing attacker-controlled commands under the guise of legitimate agent activity, and any stored credentials or session tokens used by agentic browser automation are at risk of theft via the same persistence mechanism.
Affected Systems
Windows, macOS, and Linux hosts running Google Chrome or Microsoft Edge (Chromium-based) where an attacker has already obtained administrative privileges or code execution; systems using browser profile-based automation including AI browser agents and RPA tools
Indicators of Compromise
- Modified Secure Preferences file with forged HMAC/integrity hash
- Unpacked/sideloaded Chrome extension masquerading as a bookmarks manager
- Unexpected extension entries in chrome://extensions or edge://extensions not installed via Web Store
- Anomalous outbound browser process network connections to unfamiliar C2 domains
Remediation Steps
- 1
Audit browser extensions
Review all installed extensions in Chrome and Edge across endpoints for unauthorized or unpacked/sideloaded extensions, especially ones mimicking bookmark managers.
- 2
Validate Secure Preferences integrity
Deploy monitoring to detect unauthorized modifications to the Secure Preferences file and its HMAC validation across managed endpoints.
- 3
Restrict local admin rights
Limit administrative and code execution privileges on endpoints to reduce the attack surface required for PEEP deployment.
- 4
Enforce extension allowlisting via policy
Use Group Policy/Chrome Enterprise/Edge management to enforce extension allowlists and block unmanaged extension installation.
- 5
Rotate credentials and API keys
Rotate browser-stored credentials, session tokens, and API keys used by any browser-based AI agents or automation tools potentially exposed on affected hosts.
- 6
Monitor for host command execution via browser processes
Deploy EDR rules to flag anomalous command execution or process spawning originating from Chrome/Edge processes.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.