PEEP toolkit hijacks Chrome and Edge into backdoors that run host commands

Researchers disclosed a post-exploitation toolkit called PEEP that turns Chrome and Edge into backdoors for stealing credentials and running commands on the host. After an attacker already has administrative or code-execution access, PEEP's installer injects a malicious extension disguised as a bookmarks tool directly into browser profiles, forging Chromium's own integrity settings to bypass the Web Store and skip user approval prompts. The planted extension then serves as a covert channel to harvest credentials and execute operating-system commands. Because it abuses a trusted, ever-present browser and hides its extension from the usual checks, it can persist quietly on a compromised machine, a reminder that browsers themselves are a rich post-compromise attack surface.

Check

Hunt for tampering with Chromium's secure preferences file and for extensions loaded outside the Web Store, and treat an unexpected browser extension on a server or admin workstation as a possible backdoor.

Affected

Windows systems an attacker already compromised with admin or code-execution access; PEEP silently installs a browser extension by forging integrity settings, then uses it to steal credentials and run host commands.

Fix

Enforce enterprise extension allowlisting through browser policy, monitor for secure-preferences tampering and unapproved extensions, restrict local administrator rights that enable the install, and include browser artifacts in endpoint detection and incident response.