Loading story…
Researchers identified PEEP, a Chromium browser-extension remote-access and post-exploitation toolkit derived from RedExt that masquerades as a Smart Bookmarks extension. Once an operator has obtained prior code execution or administrative access, PEEP can persist in Chrome or Edge through extension sideloading, enterprise policies, forged Secure Preferences integrity values, or a ScriptCache fallback; it collects browser telemetry and cookies, polls command-and-control (C2) over plaintext HTTP, and uses a native-messaging host to execute commands and manipulate files as the logged-in user.
The reported staging and C2 infrastructure was hosted at 206.237.30.232 on ports 5001 and 5002, reflecting adversary acquisition and use of external infrastructure. An exposed repository reportedly contained source code, iterative builds, logs, and the extension's primary private signing key. Traditional Chinese-language development artifacts indicate a likely Chinese-speaking operator, but no victims, campaign targets, confirmed criminal use, or nation-state attribution have been established.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers assessed the unidentified PEEP operator as probably Sinophone with moderate confidence, citing Traditional Chinese text in the C2 panel and QA artifacts. The report also characterized the operator's operational security as weak because of exposed signing keys, static beaconing, and unencrypted C2 traffic.
SOCRadar detailed that the RedExt-derived PEEP “Smart Bookmarks” extension can steal browser sessions and data and use a native-messaging host to execute shell commands and conduct file and process operations on compromised Windows hosts. The report identified persistence methods, including forged Secure Preferences values, force-install policies, sideloading, and ScriptCache fallback, along with extension IDs, domains, host artifacts, and API endpoints; the reported server counts did not confirm victim numbers.
Researchers documented PEEP, a RedExt-derived Chromium browser-extension remote-access toolkit masquerading as “Smart Bookmarks,” operating from 206.237.30.232. The exposed infrastructure reportedly included a C2/API service, staging repository, iterative builds, source code, logs, and the private signing key for the primary extension identity; no victims or confirmed deployments were identified.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 26 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
8 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecyberveille.ch
Open sourcecysecurity.news
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcesocradar.io
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs documented **REF9334**, a Brazil-focused banking-malware operation active since at least May 2025 that delivers the KREMLIN toolkit through Portuguese-language document lures impersonating financial institutions. Multi-stage JavaScript, Node.js, and C++ components use anti-analysis checks, RunPE execution, and SentinelOne DLL sideloading; the campaign has also deployed PULSAR and REMCOS remote-access trojans. KREMLIN silently installs a malicious Chromium extension named **“AVSync System Inc.”** by modifying Chrome and Edge Secure Preferences and regenerating browser integrity values. The extension can collect saved credentials, cookies, session tokens, browser storage, page content, screenshots, and keystrokes. Its operators use Ethereum smart contracts as resilient dead-drop resolvers for mutable payload and C2 configuration, alongside Archive.org-hosted JPEG carriers. After researchers registered an unclaimed network-canary domain, 1,515 infected hosts checked in—98.75% of them geolocated in Brazil—before implants identified the environment as a sandbox and halted later-stage activity.
Sep 18, 2026
Researchers allege that **Poper Blocker**, a Chrome popup and ad-blocking extension with more than 2 million users, covertly collects complete browsing URLs and referrers, AI-chat content, advertising and social-media data, and browser-fingerprint information. The extension reportedly contains an obfuscated interpreter that retrieves remotely hosted programs and a command dictionary from `api.pbapi.xyz`, allowing its operator to change collection and exfiltration behavior without submitting a new Chrome Web Store-reviewed update. Researchers also reported that the same remote capability can inspect page content, HTTP request and response bodies, and WebSocket traffic; capture page-region screenshots; compress collected data; and upload it to destinations selected by the server. The report describes delayed payload delivery, sandbox and automation detection, consent gates, code obfuscation, and use of a cross-device identifier drawn from Chrome Sync storage as anti-analysis and tracking measures. Poper Blocker reportedly remained featured and verified in the Chrome Web Store after an earlier May report alleged AI-chat scraping, while its Microsoft Edge listing is said to use the same remote configuration. If confirmed, the reported data collection and remotely alterable behavior would conflict with Chrome Web Store Limited Use requirements, which limit Google API-derived user data to disclosed, single user-facing purposes and prohibit undisclosed transfers, advertising use, and other restricted processing.
Sep 28, 2026
Zscaler ThreatLabz reported that an initial access broker linked to **Payouts King ransomware** is deploying **Edgecution**, a malware framework that combines a malicious Microsoft Edge extension with a Python backdoor. The intrusion typically starts with Microsoft Teams social-engineering messages impersonating IT staff and directing targets to a fake Microsoft Outlook or Microsoft update page, which delivers deployment scripts, a legitimate AutoHotKey executable, and an encrypted ZIP archive. The scripts then create a hidden Edge profile, install the extension and Python components, configure a Chrome native messaging host, store a decryption key in the Windows registry, and schedule Edge to run headlessly with the malicious extension loaded. Edgecution abuses Chrome native messaging to bypass normal browser sandbox restrictions and relay privileged commands from the extension to the Python backdoor. Researchers said the extension communicates with command-and-control infrastructure over WebSockets, with observed `cloudfront.net` subdomains hosted on AWS, while the browser-monitoring features appear to be a decoy because Edge runs in headless mode. The backdoor provides operators with system reconnaissance, process enumeration, file-writing capability, shell and PowerShell execution, Python code execution, and broader arbitrary command execution, giving ransomware-affiliated actors a stealthy foothold that may evade some traditional endpoint and sandbox defenses.
Jul 24, 2026