PEEP: Chromium post-exploit toolkit via Smart Bookmarks extension (SOCRadar)
SOCRadar published research on 4 September 2026 documenting PEEP, a Chromium-based post-exploitation toolkit that requires prior admin or code-execution access. An installer injects a malicious extension masquerading as "Smart Bookmarks" into Chrome/Edge profiles; the extension (based on the open-source RedExt framework) beacons for commands, harvests browser data, and uses a native messaging host (nm_host.exe) for host-level command execution and file management.
Mixed Chinese-language artifacts support a likely Chinese-speaking operator, per SOCRadar. (source: SOCRadar)
Correction (31 Oct 2026): the card is now dated 4 September 2026, the date of SOCRadar's research. (source: SOCRadar)
Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: SOCRadar)
- Product
- Google Chrome / Microsoft Edge (Chromium) post-compromise
- Exploited in Australia?
- unknown
- Patch to
- Hunt unexpected Smart Bookmarks extension and nm_host.exe native messaging hosts; treat forged Secure Preferences integrity as hostile