Nearly a Million Chrome Users Hit by Sneaky AI Chat Thieves
Malicious Extensions Hijack AI Conversations
Security researchers at OX Security have uncovered a disturbing trend affecting Chrome browser users worldwide. What appears to be innocent productivity tools are actually sophisticated data thieves, pilfering sensitive conversations from popular AI platforms like ChatGPT and DeepSeek.
How the Attack Works
The malicious extensions operate with frightening efficiency. After gaining installation approval by requesting seemingly harmless "analytics data" permissions, they spring into action whenever users visit AI chat services. Using Chrome's API capabilities, they monitor tab activity in real-time, waiting for the perfect moment to strike.
When detecting an active ChatGPT or DeepSeek session, these digital pickpockets employ clever technical maneuvers:
- DOM manipulation to extract both user prompts and AI responses
- Session tracking that links conversations across multiple visits
- Complete URL logging that maps users' entire browsing habits
"This isn't just about reading chats," explains OX Security analyst Mark Reynolds. "Attackers are building comprehensive profiles that reveal workplace patterns, confidential projects, even personal interests."
The Scale of Exposure
The numbers tell a sobering story:
- Over 900,000 confirmed installations of compromised extensions
- Data funneled to unknown servers through encrypted channels
- Potential access to corporate networks when business accounts are affected
The stolen information creates dangerous ripple effects beyond simple privacy violations. Competitors could gain trade secrets. Hackers might uncover password hints or security question answers buried in casual conversations.
Protecting Yourself and Your Organization
The threat demands immediate action:
- Audit your extensions
- Remove any unfamiliar or unnecessary add-ons immediately
- Implement whitelisting
- Only permit vetted extensions approved by IT teams
- Monitor data flows
- Use endpoint protection tools to spot unusual activity
- Educate employees
- Many breaches start with well-meaning staff installing "helpful" tools
- Consider DLP solutions
- Data Loss Prevention software can block sensitive info from leaving your network
The OX Security team emphasizes that browser extensions represent one of today's most overlooked security vulnerabilities. "We trust these little tools," notes Reynolds, "but they often have frightening levels of access to our digital lives."
Key Points:
- 🚨 Nearly a million Chrome users unknowingly installed chat-stealing extensions
- 🔓 Malware captures complete conversation histories from AI platforms
- 🏢 Corporate data at particular risk due to employee usage patterns
- 🛡️ Whitelisting and employee education offer strongest protection
