PEEP: The Bookmark Extension That Backdoors Your PC
A post-compromise toolkit disguised as a “Smart Bookmarks” extension forges Chromium’s integrity checks, then bridges the browser to the OS through a native-messaging host.
First Seen: 2026
Targeted Regions: Worldwide
Malware: PEEP
Attack: PEEP is a Chromium-based post-compromise toolkit that disguises itself as a “Smart Bookmarks” browser extension and quietly turns Chrome or Edge into a full backdoor. It has no way into a machine on its own; the operator must already hold code execution or administrative access, but once installed, it forges the browser’s own integrity checks to load without prompts, beacons to its command server every 30 seconds over plain HTTP, and steals session cookies, browsing history, form data, and clipboard contents. A native-messaging companion (nm_host.exe) then bridges the browser to the operating system, letting the attacker run shell commands, move files, and enumerate processes and services. Built on the open-source RedExt framework, PEEP layers four persistence tricks so that removing the visible extension alone won’t clear the infection.
Attack Details
super_mac so the browser’s integrity check passes and the sideloaded extension auto-enables at launch. If that route is blocked, the operator falls back on enterprise force-install policies or plain sideloading.com.peep.lab, a Node.js binary packed as nm_host.exe. Browser-only tasks like screenshots or JavaScript injection run inside the extension, but anything that needs the operating system is handed to this host, which turns a browser spy into a remote-access tool. Persistence is stacked across four mechanisms: the forged Secure Preferences state, an enterprise force-install policy, the registered native host, and a “Ghost Anchor” ScriptCache trick that reloads a previously compiled malicious worker even after the on-disk files are swapped for clean shells.cmd, PowerShell, or bash. The stolen cookies are the sharpest edge: a valid one proves the user is already signed in, letting an attacker replay it into accounts without a password and often without a fresh MFA prompt until the session is revoked.206[.]237[.]30[.]232, fronted by xfjcc[.]fun in AS55933 polling /api/commands for tasks. Auto-collected data posts to /api/exfil and command results to /api/agents/<id>/task_result, with registration, heartbeats, and payload updates handled through /api/register, /api/agents/<id>/heartbeat, /api/extension_update/, and /api/extension_crx/. The control panel runs on TCP port 5001 (Flask and SQLite), with an exposed development and staging repository on port 5002. The native host’s code supports AES-256-GCM, but the shipped configuration never uses it, so the channel stays in the clear.Recommendations
Add blocking rules at the network perimeter and egress firewalls for the IP 206[.]237[.]30[.]232 and the domain xfjcc[.]fun along with its new., newadmin., and newapi. subdomains. Restrict and monitor traffic to TCP ports 5001 and 5002.
Use enterprise management policies to identify and force-uninstall extension IDs ejkndncpkdcjcikfhiamcdehdoegilbj and bibjjhidpdmfcbkodddndmoejcloobdh. Delete the native-messaging registration under NativeMessagingHosts\com.peep.lab, remove nm_host.exe, and clear the staging path at %LOCALAPPDATA%\PEEP.
Configure EDR rules to flag writes to the browser’s Secure Preferences file by anything other than the browser itself, especially PowerShell, and alert on manipulation of protection.macs or super_mac values.
Enforce strict extension allow-listing through Group Policy or MDM, disable developer mode across the enterprise, restrict external sideloading, and permit only approved corporate binaries as native-messaging hosts.
Turn on App-Bound Encryption to shield cookies and browser storage from process-level theft, and require phishing-resistant MFA such as FIDO2 or WebAuthn hardware keys.
Potential MITRE ATT&CK TTPs
Indicators of Compromise (IOCs)
| Type | Value |
|---|---|
| SHA256 | 86a5fb2f14d175d1c13a7b49b55b968b2a5e96afc944d85a31b3db906af00beb,6700e30a3224248085d30f2eb727cea28dec288355fca6753449a26d1c1d1eee,9402c0198ae5c8bed14cdeaabe7e8b25625debbc62a900cfcdb82d34a35ab528,8edd653910f3217c96a603e8ce9e5e409d3b8674476f22e0a3afe870bf3870b1,87db7138a80117ddf2989827c1dde09ee73c7a252d511c74ed66af2fe34e2987,259d8eddb6caf509d7bffa2b4c0dd7d89668800c870f529729ac2efdc1853fb6,e46aee4ca43ba66666f6572c62365cf57642f2cf1f6eca00fcf8eb33a291d66d,f031c00f592aa5e98893b4532f743362fed7fb0a485e8a3c0ad4de677f1d7415,a43bf7f81507c8f9d0942fed331e7590a43044a6d219ec1005974bf1a81974a1,b4e3ca8f44477b9ade1272f92516202f83a80219c8bd6176527a6d624214e893,8e988b915b75dd749e3f4e1ca7ee21746885b4fe34e8a246e6f10f5d892a675f,9c6b269e5087a40b4552f72e9ff13d9b39e433af5075ad68f57e9b5240a590d8,207e0d47c4e5493ef7313eb1faeb1c6195923c89f263e548609a6838dd91ec0c |
| IPv4 | 206[.]237[.]30[.]232 |
| Domains | xfjcc[.]fun, new[.]xfjcc[.]fun, newadmin[.]xfjcc[.]fun, newapi[.]xfjcc[.]fun |
| HTTP Header | X-PEEP-Agent-Key, X-PEEP-Agent-Id, realm="PEEP" |
| Extension ID | ejkndncpkdcjcikfhiamcdehdoegilbj, bibjjhidpdmfcbkodddndmoejcloobdh, hpjgilbbdmfcnaapjbofmmmjjfijbdki, akhljhifabhkcoboncoiekfpdodjaack, eljagiodakpnjbaceijefgmidmpmfimg |
| Native Messaging Host | com.peep.lab |
| Agent Key | a6dfab5a6e510ece, 348e99545a69b184 |
| Encryption Key | peep_nm_host_aes256_key_32bytes! |
References
What Next?
At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.
.svg)