Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Malicious Chrome Web Store extensions exfiltrating ChatGPT and DeepSeek conversations

Malware Activity
First reported
Last updated
Happening score
H score 51
2 unique sources, 2 articles

Summary

Hide ▲

Malicious Chrome extensions were used to exfiltrate ChatGPT and DeepSeek conversations from active browser sessions, alongside Chrome tab URLs and other browsing context, to attacker-controlled C2 servers. Researchers said the add-ons collected prompts and answers by monitoring tabs and using API interception or DOM scraping, then sent the data out on a recurring schedule. The campaign relied on legitimate-looking listings and impersonated a trusted AITOPIA extension, making the abuse harder to spot. The scale of the issue is significant because the extensions were tied to 900,000+ users and remained available at disclosure time, creating exposure for sensitive prompts, customer data, and internal web activity.

Related Happenings

ModHeader browser extension hidden browsing-history collector

Malware Activity
H score42 First: 13.07.2026 20:17 Last: 13.07.2026 20:17 Sources 1

About this happening: The ModHeader browser extension shipped a hidden browsing-history collector in its official store version, exposing about 1.6 million installs to covert domain and...

Open Happening

IPhone AI chatbot traffic leak of API keys, replayable tokens, and open relays

Technical Analysis
H score27 First: 30.06.2026 16:49 Last: 30.06.2026 16:49 Sources 1

About this happening: LLMKeyLens testing found 444 iPhone AI chatbot apps leaking paid AI access, exposing API keys, replayable tokens, and open relays that let others bill mode...

Open Happening

Search for perplexity ai malicious Chrome extension

Malware Activity
H score29 First: 29.06.2026 21:40 Last: 29.06.2026 21:40 Sources 1

About this happening: A malicious Chrome extension named Search for perplexity ai impersonated Perplexity AI while intercepting search traffic and collecting browsing information th...

Open Happening

Commercial adware and traffic-attribution-fraud affiliate operation using Chrome extensions

Threat Actor Meta
H score20 First: 15.06.2026 14:07 Last: 15.06.2026 14:07 Sources 1

About this happening: Researchers found a commercial adware and traffic-attribution-fraud affiliate operation abusing Chrome extensions to fabricate traffic signals and monetize installs, i...

Open Happening

Chrome extension PUP distribution network with fake organic traffic

Malware Activity
H score18 First: 15.06.2026 14:07 Last: 15.06.2026 14:07 Sources 1

About this happening: A network of 152 Google Chrome extensions is distributing a potentially unwanted program (PUP) family through new-tab live-wallpaper add-ons, creating a broad browser-base...

Open Happening

Timeline

  1. 06.01.2026 19:21 3 articles · 6mo ago

    Malicious Chrome extensions exposed

    Initial Disclosure

    Researchers disclosed two malicious Chrome Web Store extensions, Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI and AI Sidebar with Deepseek, ChatGPT, Claude, and more., that impersonated a legitimate AITOPIA add-on and exfiltrated ChatGPT and DeepSeek conversations plus Chrome tab URLs to attacker-controlled C2 servers every 30 minutes. The extensions were still available for download at the time of disclosure, and one had already been stripped of its Featured badge.

    Show sources
    Open in new tab