Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

PEEP Chromium post-compromise backdoor

Malware Activity
First reported
Last updated
Happening score
H score 29
1 unique sources, 1 articles

Summary

Hide ▲

The PEEP toolkit now turns Chrome/Edge into a persistent post-compromise backdoor, enabling credential theft, session abuse, and host command execution. It is installed as a fake bookmarks extension, uses a native-messaging bridge to cross into the OS, and maintains access through sideloading and preference tampering. The toolkit also polls a remote C2 and exfiltrates browser data, widening the blast radius of each infected browser.

Related Happenings

AmnesiaStealer macOS infostealer distributed via ClickFix

Malware Activity
H score16 First: 14.08.2026 13:45 Last: 14.08.2026 13:45 Sources 1

About this happening: AmnesiaStealer is a Rust-based macOS infostealer spread through a counterfeit GitHub "Download for macOS" page and ClickFix-style lure. It steals Keychain, b...

Open Happening

ClickFix AmnesiaStealer distribution campaign targeting mac users

Campaign
H score22 First: 14.08.2026 13:45 Last: 14.08.2026 13:45 Sources 1

About this happening: A ClickFix campaign is distributing AmnesiaStealer to macOS users through a counterfeit GitHub "Download for macOS" page and a copy-and-paste command that launches...

Latest development: 16.08.2026 18:07

Jamf described AmnesiaStealer's stream_module and remote_stream commands, which copy a victim's Chromium profile into a hidden headless browser and open WebSocket and Chrome DevTools Protocol channels through webSocketDebuggerUrl. The operator can issue navigation and mouse commands, receive live screencasts, and export or import cookies to operate online portals inside the victim's authenticated sessions on Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium.

Open Happening

Venom Stealer MaaS continuous credential theft and exfiltration

Malware Activity
H score29 First: 01.04.2026 16:30 Last: 01.04.2026 16:30 Sources 1

About this happening: The Venom Stealer malware-as-a-service platform has been identified as a credential-theft threat that keeps exfiltrating data after infection, extending the window for...

Open Happening

Torg Grabber browser-extension theft activity

Malware Activity
H score36 First: 25.03.2026 20:32 Last: 25.03.2026 20:32 Sources 1

About this happening: The Torg Grabber infostealer is actively stealing data from 850 browser extensions, including 728 cryptocurrency wallet extensions, which raises the risk of account ta...

Open Happening

VoidStealer debugger-based ABE-bypass infostealer

Malware Activity
H score29 First: 22.03.2026 16:32 Last: 22.03.2026 16:32 Sources 1

About this happening: VoidStealer now uses a debugger-based ABE bypass to steal Chrome master keys, increasing the risk of browser credential and sensitive-data theft. The infostealer can e...

Open Happening

Timeline

  1. 07.09.2026 21:12 2 articles · 1h ago

    PEEP turns Chrome and Edge into a persistent post-compromise backdoor

    Initial Disclosure

    Cybersecurity researchers disclosed PEEP, a Chromium-based post-exploitation toolkit that masquerades as the "Smart Bookmarks" extension for Chrome/Edge. The toolkit requires prior administrative or code execution access, injects itself into browser profiles by forging Chromium Secure Preferences integrity values, and uses a native-messaging bridge plus "nm_host.exe" to run shell commands, manage files, discover processes and services, hijack sessions, and exfiltrate browsing history, active-tab metadata, cookies, and other browser artifacts. PEEP also polls C2 hosts "206.237.30[.]232" and "xfjcc[.]fun" every 30 seconds over plaintext HTTP, while persistence is reinforced through sideloading, enterprise force-install policies, preference tampering, and a ScriptCache fallback.

    Show sources
    Open in new tab