PEEP is a modular browser RAT derived from the open-source RedExt C2 framework (Manifest V3 Chrome extension + Flask/SQLite control panel, authored for legitimate red-team work) and weaponized into an operational post-exploitation toolkit. It is strictly a post-compromise framework: it has no initial access vector of its own and requires the operator to already possess administrative privileges or prior code execution on the target before installation. SOCRadar observed this active at the time of analysis: the C2 host resolved to 206.237.30.232 (AS55933, Cloudie Limited, Hong Kong) with domains xfjcc.fun and subdomains new, newadmin, and newapi; TCP 5002 exposed a development repository containing source code, builds, logs, utilities, and the private key for the primary extension identity, while the unauthenticated /health endpoint on the port-5001 control panel showed 34 agent entries, roughly 10 active sessions, and 507 stored data records (test entries cannot be differentiated from real infections). The control panel is a Flask-and-SQLite C2 application (consistent with its RedExt lineage) reached over plaintext HTTP on port 5001; agent requests carry the custom headers X-PEEP-Agent-Key and X-PEEP-Agent-Id, and authenticated responses use the realm="PEEP" challenge.

The implant masquerades as a benign extension called Smart Bookmarks (version 1.3.0) and is not available on the Chrome Web Store; it is installed via sideloading, group policy force-install (ExtensionInstallForcelist / ExtensionSettings), or Chromium Secure Preferences manipulation. The main agent runs as an MV3 service worker backed by a content script (content.js) injected into every active web page, and requests broad permissions: cookies, tabs, history, downloads, bookmarks, scripting, proxy settings, native messaging, and all HTTP/HTTPS origins. Browser-resident capabilities run locally within the extension (full-page / viewport screenshots via chrome.tabs.captureVisibleTab, clipboard content, JavaScript injection, history and bookmark harvesting, active-tab metadata, local/session storage and DOM snapshot capture, form-input capture including password-like web fields). The service worker beacons to the C2 every 30 seconds over unencrypted HTTP, polling /api/commands for new tasks, registering via /api/register, posting results to /api/agents/<id>/task_result, and auto-collecting cookies, history, tabs, URL, IP, locale, and time zone to /api/exfil. Extension updates are delivered through /api/extension_update/ and /api/extension_crx/ endpoints, effectively giving the operator in-place payload refresh.

For OS-level operations the extension bridges out of the browser sandbox through Chrome's Native Messaging API to nm_host.exe, registered as com.peep.lab under the Chrome/Edge NativeMessagingHosts registry keys. The host runs in the compromised user's security context (no inherent privilege escalation) and supports shell command execution, file operations (list directories, read/write files, search for sensitive documents, create folders, rename, compute hashes, delete paths), process enumeration, and service enumeration. Credential impact is achieved primarily by stealing active session cookies, giving access to authenticated web accounts without passwords or MFA, and by capturing password-like form fields, rather than by decrypting Chrome's stored password database.

Persistence is multi-layered: (1) the installer forges Chromium's Secure Preferences integrity values, including per-entry HMACs and the top-level HMAC-SHA256 super_mac, so the modified extension settings appear legitimate to Chrome on next launch; (2) enterprise force-install/extension-settings group policies are abused; (3) Developer Mode is enabled to sideload arbitrary extensions (install_silent.ps1) and force_enable.ps1 strips the extension from Preferences' external_uninstalls, stages the CRX under %LOCALAPPDATA%\PEEP\crx, re-registers via the HKCU Extensions key and an External Extensions JSON manifest, then restarts the browser; (4) a ScriptCache fallback preserves the compiled malicious MV3 service worker so it reloads after browser restarts while only benign source files remain visible to manual review. Because the operational logic runs inside the signed browser process, the toolkit evades detection pipelines that key on new or unsigned binaries. A Python variant, patch_secure_prefs_linux.py, indicates the operator is adapting the Secure Preferences injection for Linux Chrome/Edge profiles. SOCRadar additionally noted references in the tooling to an 'Authorized CTF' use case, a framing commonly used to lower the safety guardrails of AI coding assistants during development. The nm_host.exe PE TimeDateStamp of July 2022 stems from the base pkg Node image used to build it, not the actual build date.

The activity is currently unattributed, though Chinese-language artifacts embedded in the source code point to a Chinese-speaking threat actor. The toolkit shares lineage with the GlassWorm supply-chain campaign (November 2025), which weaponized a fork of the same RedExt framework with near-identical Secure Preferences / super_mac HMAC injection tradecraft. BeaconBeagle correlation lookups for the C2 IP (206.237.30.232) and domain (xfjcc.fun) returned no registered C2-framework signatures, indicating the malware's Flask/SQLite panel is outside the tracked C2 frameworks catalog. From a defense perspective, PEEP is best understood as an endpoint-and-identity incident in one: detection should focus on extension inventory review (the two extension IDs), native-messaging host registrations, ~30-second HTTP beaconing to the known C2, PowerShell modifying Chromium preference files or external extension manifests, and remediation must remove the extension, the native-messaging host, registry entries, and staged CRX artifacts before rotating sessions and credentials.