The Latest Cyber Threat: PEEP Malware Targets Browsers

According to a recent report from The Hacker News, security researchers have uncovered a new cyber threat called PEEP that turns Google Chrome and Microsoft Edge into hidden backdoors. This toolkit sneaks in as a fake bookmarks extension and gives attackers full control over a victim's computer.

What makes this threat significant is that it doesn't break in on its own — it needs someone to already have access to your system. Once inside, PEEP uses the browser's own tools to steal passwords, take screenshots, and run commands on the host machine. This approach is clever because it hides inside a trusted program that most businesses rely on every day.

Why Browsers Are the New Weak Spot for Hackers

Attackers are shifting their focus from traditional malware to browser-based tools because browsers have deep access to our data and systems. PEEP works by injecting itself into Chrome and Edge profiles without going through the official app stores, making it hard for standard antivirus software to catch it.

This type of attack is especially dangerous because it operates inside a signed browser process. Security tools often trust browsers, so the malicious activity can slip by unnoticed. For Australian businesses, this means that simply having antivirus installed is no longer enough — you need to watch what your browsers are doing too.

What This Means for Australian SMBs

Small and mid-sized businesses in Australia often have limited IT budgets and fewer security staff. A threat like PEEP that targets browsers can go undetected for weeks, giving attackers time to steal customer data, login credentials, and even financial information.

Because PEEP is a "post-compromise" tool, it usually arrives after another breach — like a phishing email or a weak password. That means the real defense starts before the browser is ever targeted. Australian SMBs need to strengthen their basic security habits to block the initial entry points that open the door for tools like PEEP.

What You Can Do Now

  • Review browser extensions weekly. Check every extension installed in Chrome and Edge. Remove anything you don't recognise or that wasn't installed by you. Look out for names like "Smart Bookmarks" or any add-on with vague descriptions.
  • Limit administrative privileges on employee devices. Only give admin rights to people who absolutely need them. PEEP requires admin-level access to install, so restricting this reduces your risk significantly.
  • Use endpoint detection and response (EDR) tools. Standard antivirus often misses browser-based threats. EDR software monitors unusual behaviour - like a browser suddenly trying to run system commands - and can alert you in real time.
  • Train staff on phishing awareness. Since PEEP needs an initial breach, employees should know how to spot fake emails and avoid clicking suspicious links or downloading attachments.
  • Keep browsers and all software updated. Updates often fix security holes that attackers use to get in. Set automatic updates for Chrome, Edge, and any plugins.

Staying ahead of threats like PEEP can feel overwhelming, but you don't have to do it alone. At MS&VG, we help Australian SMBs build practical defences that match their budget and risk level - from browser security checks to full incident response planning.