PEEP Sideloader Forges Chromium Secure Preferences to Enable Host Command Execution via Native Messaging

The toolkit installs via three PowerShell scripts that enable Developer Mode, patch preferences integrity checks, and force-enable the sideloaded extension. It registers with the C2 at /api/register, sends heartbeats with User-Agent and timezone data, then exfiltrates cookies, tabs, and history over plaintext HTTP. Browser commands execute locally while host tasks route through the native messaging host, turning the extension into a full remote access tool with file management and process discovery.

PEEP builds directly on the open-source RedExt framework previously used in GlassWorm operations, adding dedicated installers, an update channel, and expanded command surface. Chinese-language strings in the code provide the only attribution signal, yet no infrastructure overlap or tooling reuse has been independently verified against known Chinese groups. The absence of an initial access vector confirms its post-compromise role.

Official reporting from SOCRadar emphasizes evasion of Web Store checks, but understates how the same preference-manipulation technique appears in multiple enterprise policy abuse cases documented in prior red-team tooling disclosures. This pattern suggests operators are adapting legitimate administrative workflows rather than novel zero-days.

Next steps include monitoring for PEEP-derived extensions in managed browser deployments and checking for nm_host.exe instances tied to the com.peep.lab manifest. Endpoint detection focused on Secure Preferences file changes will surface similar sideloading attempts before C2 registration occurs.