PEEP Post-Exploitation Browser RAT Summary

PEEP is a sophisticated post-exploitation framework targeting Chromium-based browsers (Chrome and Edge) to establish persistence and host-level control. Disguised as a 'Smart Bookmarks' extension, PEEP requires prior administrative or code execution access to forge Chromium Secure Preferences integrity values, allowing it to bypass Web Store checks and user prompts. The toolkit is built upon the open-source RedExt framework but significantly expands its capabilities with a native host bridge and an extensive command set.

The technical core of PEEP involves a Manifest V3 extension agent that communicates with a C2 server via unencrypted HTTP beacons every 30 seconds. By leveraging a native-messaging host (nm_host.exe), the malware breaks the browser sandbox to execute shell commands, manage files, and discover system processes. The presence of Chinese-language artifacts and automated CI/CD build traces suggests a proficient Chinese-speaking developer, potentially using AI-assisted development tools to bypass safety guardrails.

This threat is critical for organizations because it allows attackers to pivot from a standard browser process to full host compromise. By operating within the context of a signed browser executable, PEEP effectively evades traditional EDR detections that focus on unsigned or anomalous binaries, making it a powerful tool for session hijacking and credential theft.