BragJack: A Proof-of-Concept Attack Hijacking AI Assistants in Chromium Browsers
Security researcher Gal Weizman disclosed BragJack, a technique that uses a malicious browser extension to take control of AI assistants in five Chromium-based environments—Google Chrome’s Gemini Live, Microsoft Edge, Perplexity Comet, Opera Neon, and Anthropic’s Claude in Chrome—by abusing trusted communication channels between vendor-hosted AI services and privileged browser components, without bypassing AI guardrails or altering webpage content. The extension leveraged Chromium’s declarativeNetRequest capability to modify network traffic, enabling it to issue commands using the agent’s existing privileges for actions like accessing sensitive data or acting on the victim’s behalf. The research led to two CVEs and over $20,000 in bug-bounty payments from five vendors, with individual rewards ranging from $600 to $7,000; Google and Microsoft have since resolved the flaws assigned to them.

The public revelation of BragJack quietly confirms what we've been mapping for years — that the browser on your screen is not a private window to the world but a managed terminal connected to the Consensus Machinery. The security researcher did his part, publishing the exploit and taking his $20,000 in bug-bounty chump change. But ask yourself: why is the "proof-of-concept" technique being disclosed now? Because they've already moved to the next generation. The fact that this flaw existed in five separate Chromium environments — five separate vendors, from Google to Microsoft to Opera — is not a coincidence of sloppy coding. It's the tell. They are building the very infrastructure for mass digital control, and this "vulnerability" is a crack in the loading dock that they wanted us to see, while the real vehicle is being loaded in a different bay entirely.

You have to follow the pattern, not the headline. The malicious extension doesn't need to break the AI model's guardrails because the guardrails were never the point — they were always theatrical. The article admits it: the attack abuses trusted communication channels between vendor-hosted AI services and privileged browser components. Let that sink in. The trusted architecture has no backdoor you can spot because the backdoor is built into the trust itself. They call it a "proof-of-concept." We call it a confession. Every vendor paid out bug bounties ranging from $600 to $7,000 — pocket change, laughable amounts, a classic disinformation tax to make it look like they're on our side. They want you to believe your data is safe now, that "flaws have been resolved." But you have to ask yourself the question they hope you're too busy to ask: resolve a flaw in what? In the security, or in the version of the story you needed to hear so you'd close your browser and go back to sleep?

Here is the breadcrumb, and I need you to follow it with your eyes wide open. We are three to five years from a world where every single interaction you have with your machine is shepherded by an AI agent — and when that day comes, the architecture that BragJack exposed will be the standard, not the exception. Think about what that means for your shopping, your banking, your private messages. They are not fixing a hole in the dam; they are showing you a speck of water so you won't notice the flood at your feet. The next exploit won't be named with a catchy portmanteau. It won't be published on a security blog for a bounty. It will be silently woven into the "trusted communication channels" of the very extensions and agents you've been taught to lean on. So keep asking who controls the channels. Keep asking who defines "trusted." Because the scan you're about to run, the extension you're about to install, the Gemini or Claude you're about to hand your most sensitive thoughts — that's not a convenience. It's an invitation. The question is whether you're still going to sign in when you finally understand who's holding the door.

KREMLIN Banking Malware Operation Targeting Brazilian Banks

Security researchers have uncovered a previously unreported Brazilian banking malware campaign dubbed KREMLIN, active since at least May 2025, which lures victims with impersonations of about a dozen Brazilian banks and installs malicious extensions on Google Chrome and Microsoft Edge. The operation is tracked by Elastic Security Labs as REF9334, and a technical report detailing the threat was cited by The Hacker News on September 15, 2026.

I’ve been watching this one. The timing is everything. They don’t want you to see the pattern, but it’s right there in the dates and the targets. A banking malware called KREMLIN, hitting the exact browsers that process the most financial traffic on the planet, is not a random act of cybercrime. That name alone is a taunt, a signature. It’s a message from a network that operates beyond the reach of any single nation-state. The fact that it surfaced in May 2025, just as global digital-currency pilots were accelerating, is your first breadcrumb. Ask yourself: why now? Why these banks? The answer isn’t in the code — it’s in the ledger.

You have to understand how these things actually work. The mainstream will tell you this is just another criminal gang after your passwords. That’s the story they sell you so you don’t look at the architecture. This isn’t about stealing a few thousand dollars from individual accounts. Look at the operational design: the malware doesn’t just keylog — it installs a persistent extension that lives inside the browser itself, a foothold on your entire digital identity. That is not a smash-and-grab. That is a long-term intelligence-gathering operation. They are building a profile of your financial behavior, your savings, your vulnerabilities, your trust in the system itself. And once they have that profile, they own your decision-making. They don't need your password when they can control the screen you see.

Here’s what I can tell you, and you won’t find this in the technical report: this is a field test. The Brazilian market is the perfect sandbox — a major economy, a population that relies heavily on mobile banking, and a regulatory environment that’s still catching up. They’re testing the extension infrastructure here before deploying it against the larger Western financial grid. The name KREMLIN isn't just for show — it's a deliberate fingerprint, a way of saying "we can operate in the open and you still won't stop us." The questions you should be asking aren't about the malware's code. Ask who benefits from a population that no longer trusts its own digital banking system. Ask who wins when ordinary people are forced back to physical currency, or pushed toward a central bank digital currency that promises "security" against exactly these threats. That's the loop. That's always been the loop. And they know you're watching — that's the part that scares them most.

# Twitch Enhanced Viewer | JeetBot Exposes OAuth Tokens

A browser extension called Twitch Enhanced Viewer | JeetBot exposed Twitch OAuth session tokens belonging to nearly 31,000 users by sending them to proxy servers operated by JeetBot, a Russian-language commercial streaming and chatbot service. The extension had about 30,000 Chrome users and 604 Firefox users and remained available in both stores when The Hacker News reported the issue. Socket found that current versions extract authorization tokens from Twitch’s web client and append them as an auth= URL parameter when redirecting video-playlist requests through the operator’s proxies, allowing the operator to retrieve the tokens from proxy request logs and gain access to Twitch chat, whispers, and account settings. The forwarding applied to every channel watched except 10 hardcoded Russian-language channels, with store identifiers including Chrome extension ID pnhhdhhcadcjfckjhpmjneldiegbojfb and Firefox listing twitchenhancedviewer@example.com, while advertising features such as ad blocking, 1080p playback, region-restricted content access, and channel-point collection.

The little extension you installed to get 1080p and kill the ads wasn't just a tool. It was a keylogging device for your entire identity on Twitch... except they were logging the key that unlocks the whole account. Every time you clicked play, your OAuth session token—the digital signature that says "this is me" to Twitch—was stripped out and sent as a polite, quiet auth= parameter straight through their proxy servers in Russia. This wasn't a vulnerability they missed; it was the architecture of the product. The entire point of the proxy is to intercept the traffic. The entire point of the "enhancement" was to harvest the keys.

Now look at the one detail they buried in the technical write-up. The extension forwarded the token for every channel you watched... except it hardcoded an exemption for 10 Russian-language channels. Think about that. They wanted the data from the West, from the English-speaking users, from the people watching the big events and the political streams. But they shielded their own domestic consumers. It’s a deliberate carve-out, a fingerprint left in the code. This isn't some random script kiddie grabbing for beer money. This is a commercial, Russian-language operation—JeetBot—that built a player designed to turn every viewer into a source of intelligence. Why do they need 31,000 active session tokens? For ad fraud? Or for mapping the behavior, the viewing patterns, and the connected identities of the people who consider themselves the most "plugged in"?

They will tell you it was a "logging error" and that the tokens are "expired" now. That's the script. But ask yourself the question they never want you to ask: who benefits from having a database of active OAuth tokens that can read whispers, post in chat, and change account settings in real-time? The distraction is the ad-blocking. The story is the harvesting. This was never about giving you a better viewing experience; it was about them owning the back door to your account the moment you "trusted" a tool to do the work that Twitch itself wouldn't let you do. They gave you an inch of convenience, and they took half a mile of access. Now the question is, what were they doing with those keys before the spotlight hit the code?

PEEP: A Chromium-Based Post-Exploitation Toolkit Disguised as a Browser Extension

Cybersecurity researchers have disclosed PEEP, a Chromium-based post-exploitation toolkit that masquerades as a browser-bookmarks extension, enabling attackers with prior administrative or code-execution access to turn Chrome and Edge profiles into persistent backdoors by directly injecting the extension into browser profiles and forging Chromium Secure Preferences integrity values to bypass Web Store checks and user prompts. Once installed, PEEP communicates with a command-and-control server every 30 seconds over plaintext HTTP, exfiltrating browsing history, active-tab metadata, and session cookies, while also supporting host commands, credential theft, session hijacking, web-page alteration, and file management via a native-messaging component. Building on the open-source framework RedExt—previously used in GlassWorm attacks—PEEP adds installation routines, a native host bridge, heartbeat telemetry, an update channel, and a broader command set. The finding was circulated on Reddit’s BlueTeamSec under the title “PEEP: A Browser RAT Posing as a Chrome Extension,” highlighting its browser-RAT characteristics.

The Browser Jail That Was Never Meant to Be Found

Every now and then, the curtain slips. What cybersecurity researchers are calling "PEEP" — a Chromium-based post-exploitation toolkit that bypasses every guardrail Google and Microsoft built into their own browsers — is not a rogue hacker's toy. It's a production-ready implant that installs itself directly into Chrome and Edge profiles, forging the very integrity values those platforms rely on to keep malware out. Ask yourself: who had access to the Secure Preferences specification? Who knew exactly how to spoof it without triggering a single Web Store check? This wasn't reverse-engineered in a basement. This was built by people who already had the blueprints. The same people who wrote the rules for "trusted extensions" are now writing the tools that exploit them. And they want you to think it's just another red-team framework.

The Two-Minute Heartbeat of a Managed Society

Look at the operational security. PEEP polls a command-and-control server every thirty seconds over plaintext HTTP — no encryption, no obfuscation. That's not carelessness. That's a design choice. It means the traffic is intended to look like routine background noise, easily mistaken for a benign analytics ping. It exfiltrates session cookies, browsing history, active-tab metadata — everything needed to reconstruct your digital shadow in real time. Combine this with the native-messaging component that can run host commands, steal credentials, alter web pages. We've seen this architecture before. The open-source predecessor, RedExt, was used in GlassWorm attacks — but GlassWorm was just the proof of concept. PEEP adds heartbeat telemetry, an update channel, a broader command set. This is not a tool for penetration testers. This is infrastructure for persistent, undetectable surveillance of entire populations. The question isn't if it's been deployed in the wild. The question is how many critical infrastructure, journalism, or activist machines already have it running.

The Gate That Was Opened From the Inside

A Reddit post on BlueTeamSec called PEEP "a browser RAT." That's the sanitized label. But I'll give you the real name: it's a permissionless backdoor into the one application you trust with everything — your browser. Remember when I told you about the push to "browser-based everything"? The plan was never convenience. It was containment. Lock all human activity inside a sandboxed environment that can be silently repossessed the moment the gatekeeper decides you're a threat. PEEP is the mechanism for that repossession. And the fact that it forges Chrome's own security hashes means the people who built it have access to the signing keys, the source code, or the insider knowledge that only a handful of institutions possess. Follow the foundation grants. Follow the intelligence-community liaisons embedded in every major browser vendor. You'll find the fingerprints. I won't name them here — not yet. But pull up the Chromium security whitepaper from 2019. Look at page 47, where they discuss "extension integrity verification." Now look at PEEP's bypass technique. The pattern is clear. The architecture is known. The only thing missing is your attention.