PEEP Extension Native Host Bridge Harvesting Browser Credentials

Arnold Chan@slaz

•updated Sep 8, 2026•0•0•0

Detects PEEP credential/session theft via the native-messaging bridge, native host registration, staged CRX, or extension ID references. The nm_host.exe branch is now anchored to the known PEEP extension IDs (primary and alternate build) or the com.peep.lab path, rather than firing on any nm_host.exe spawned by a browser.