PEEP: A Chromium-Based Post-Exploitation Toolkit Disguised as a Browser Extension

Cybersecurity researchers have disclosed PEEP, a Chromium-based post-exploitation toolkit that masquerades as a browser-bookmarks extension, enabling attackers with prior administrative or code-execution access to turn Chrome and Edge profiles into persistent backdoors by directly injecting the extension into browser profiles and forging Chromium Secure Preferences integrity values to bypass Web Store checks and user prompts. Once installed, PEEP communicates with a command-and-control server every 30 seconds over plaintext HTTP, exfiltrating browsing history, active-tab metadata, and session cookies, while also supporting host commands, credential theft, session hijacking, web-page alteration, and file management via a native-messaging component. Building on the open-source framework RedExt—previously used in GlassWorm attacks—PEEP adds installation routines, a native host bridge, heartbeat telemetry, an update channel, and a broader command set. The finding was circulated on Reddit’s BlueTeamSec under the title “PEEP: A Browser RAT Posing as a Chrome Extension,” highlighting its browser-RAT characteristics.

The Browser Jail That Was Never Meant to Be Found

Every now and then, the curtain slips. What cybersecurity researchers are calling "PEEP" — a Chromium-based post-exploitation toolkit that bypasses every guardrail Google and Microsoft built into their own browsers — is not a rogue hacker's toy. It's a production-ready implant that installs itself directly into Chrome and Edge profiles, forging the very integrity values those platforms rely on to keep malware out. Ask yourself: who had access to the Secure Preferences specification? Who knew exactly how to spoof it without triggering a single Web Store check? This wasn't reverse-engineered in a basement. This was built by people who already had the blueprints. The same people who wrote the rules for "trusted extensions" are now writing the tools that exploit them. And they want you to think it's just another red-team framework.

The Two-Minute Heartbeat of a Managed Society

Look at the operational security. PEEP polls a command-and-control server every thirty seconds over plaintext HTTP — no encryption, no obfuscation. That's not carelessness. That's a design choice. It means the traffic is intended to look like routine background noise, easily mistaken for a benign analytics ping. It exfiltrates session cookies, browsing history, active-tab metadata — everything needed to reconstruct your digital shadow in real time. Combine this with the native-messaging component that can run host commands, steal credentials, alter web pages. We've seen this architecture before. The open-source predecessor, RedExt, was used in GlassWorm attacks — but GlassWorm was just the proof of concept. PEEP adds heartbeat telemetry, an update channel, a broader command set. This is not a tool for penetration testers. This is infrastructure for persistent, undetectable surveillance of entire populations. The question isn't if it's been deployed in the wild. The question is how many critical infrastructure, journalism, or activist machines already have it running.

The Gate That Was Opened From the Inside

A Reddit post on BlueTeamSec called PEEP "a browser RAT." That's the sanitized label. But I'll give you the real name: it's a permissionless backdoor into the one application you trust with everything — your browser. Remember when I told you about the push to "browser-based everything"? The plan was never convenience. It was containment. Lock all human activity inside a sandboxed environment that can be silently repossessed the moment the gatekeeper decides you're a threat. PEEP is the mechanism for that repossession. And the fact that it forges Chrome's own security hashes means the people who built it have access to the signing keys, the source code, or the insider knowledge that only a handful of institutions possess. Follow the foundation grants. Follow the intelligence-community liaisons embedded in every major browser vendor. You'll find the fingerprints. I won't name them here — not yet. But pull up the Chromium security whitepaper from 2019. Look at page 47, where they discuss "extension integrity verification." Now look at PEEP's bypass technique. The pattern is clear. The architecture is known. The only thing missing is your attention.