Reported by 1 outlet

Timeline

1. update from cyberpress.org

   Malicious Chrome Extension Turns the Browser Into a Backdoor for Hackers

   cyberpress.org · 36d ago · September 7th, 2026

   Once installed, it can turn Google Chrome or Microsoft Edge into a persistent backdoor for stealing browser data, hijacking sessions, and executing commands on the victim’s computer. PEEP is not an initial-access malware family. Attackers first need administrative access or the ability to run code on a target system. They can then silently place the malicious extension into Chrome or Edge profiles, bypassing normal Web Store installation checks and user approval prompts. The toolkit was identified by SOCRadar’s Threat Research Unit through its Extended Threat Intelligence platform . Researchers found that PEEP is derived from the open-source RedExt framework, but adds stealthy installation methods, browser persistence, host-level control, and expanded data-theft features. Malicious Chrome Extension Backdoor The malicious extension uses a Manifest V3 service worker and runs in the signed browser process. This can help it avoid security tools that mainly look for suspicious new executable files. PEEP collects browser cookies, browsing history, bookmarks, active tabs, downloads, browser settings, public IP address, language, time zone, and other system details. Stolen cookies are especially dangerous because attackers may use them to hijack authenticated sessions without needing a victim’s password. Architecture Overview (Source: socradar) The extension can also capture web-page content, local storage, session storage, screenshots, clipboard data, submitted forms, and password-l