Loading story…
Researchers reported a coordinated campaign dubbed AiFrame involving 30+ malicious Google Chrome extensions masquerading as AI assistants (impersonating tools like ChatGPT, Claude, Gemini, and Grok) that collectively reached roughly 260,000–300,000 installs. The extensions were found to steal credentials, API keys, email content/messages, and browsing data, and multiple items remained available in the Chrome Web Store at the time of reporting.
LayerX attributed the set to a single operation based on shared code structure, permissions, and common command-and-control infrastructure under tapnetic[.]pro (including subdomains such as claude.tapnetic.pro). The extensions typically did not implement AI features locally; instead, they rendered a full-screen iframe that loaded remote content, enabling operators to change UI/logic and add capabilities without publishing an extension update. Reported high-install examples included Gemini AI Sidebar (fppbiomdkfbhgjjdmojlogeceejinadg, removed after reaching ~80k users) and apparent re-uploads/new IDs such as AI Sidebar (gghdfkafnhfpaooiolhncejnlgglhkhe, ~70k users), plus AI Assistant (nlhpidbjmmffhoogcennoiopekbiglbp, ~60k users, noted as having a “Featured” badge).
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
As broader media coverage continued, Dark Reading reported contacting Google for comment regarding the malicious AI-themed extensions and their continued presence in the Chrome Web Store. This marked an official press request for platform response to the disclosed campaign.
Following LayerX's publication, multiple reports noted that some of the malicious extensions remained available in the Chrome Web Store, with certain listings even marked as 'Featured.' This showed that the campaign's infrastructure and distribution had not been fully disrupted immediately after public exposure.
LayerX Security publicly reported the AiFrame campaign, linking the fake AI extensions to a single operation and stating they had amassed more than 260,000 installs, with some reports placing the total above 300,000. The disclosure highlighted the use of injected iframes to change extension behavior server-side without requiring Chrome Web Store updates.
The extensions used remote iframes and background scripts to exfiltrate visited page content, credentials-related data, and, in a Gmail-focused subset, visible emails and drafts from mail.google.com. Some also exposed remotely triggered voice transcription features via the Web Speech API, expanding surveillance and data theft capabilities.
A threat actor published at least 30 malicious Chrome extensions masquerading as AI assistants and chatbots, using shared code, permissions, and backend infrastructure tied to tapnetic[.]pro. The campaign also re-uploaded removed extensions under new IDs, indicating ongoing persistence in the Chrome Web Store.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
6 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcelayerxsecurity.com
Open sourcebleepingcomputer.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that several AI-themed browser extensions in official marketplaces covertly harvested user conversations from generative AI services including **ChatGPT, Claude, Copilot, Gemini, and DeepSeek**. G Data identified **Urban VPN**, **Smart Sidebar: ChatGPT, Claude and DeepSeek**, and **AI Assistant/Chat AI** as examples that remained outwardly functional while injecting scripts, intercepting requests, tampering with page content, or using hidden iframes to capture prompts and responses from visited AI sites. Investigators said the stolen data included conversation IDs, hostnames, timestamps, and full chat histories, with some payloads encoded in Base64 and sent to external servers. The extensions reportedly had strong ratings, large user bases, and in one case a Chrome Web Store **Featured** badge, underscoring how official store vetting can miss dynamic malicious behavior such as remote iframe communications; researchers warned that AI-focused extensions now expose a broad attack surface and urged enterprises to enforce strict extension allow-listing, minimize permissions, and remove unnecessary add-ons from systems accessing sensitive AI platforms.
Jun 29, 2026
Two rogue Chrome extensions, impersonating the legitimate AITOPIA AI sidebar tool, have compromised over 900,000 users by exfiltrating ChatGPT and DeepSeek conversations along with full browsing histories to attacker-controlled servers. The extensions, named "Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI" and "AI Sidebar with Deepseek, ChatGPT, Claude and more," request consent for "anonymous analytics" but covertly steal sensitive data, including proprietary code, business strategies, PII, and internal URLs. The malware operates by monitoring browser tabs, scraping chat content and session IDs, and sending Base64-encoded data to C2 servers every 30 minutes, exposing users to risks such as espionage, identity theft, and phishing. Researchers from OX Security discovered the threat, noting that the extensions remain available on the Chrome Web Store, with one losing its "Featured" badge after disclosure. The extensions also redirect users to each other if uninstalled, and their privacy policies are hosted on third-party sites to obscure their origins. The incident highlights the growing trend of browser extensions being used to capture AI chatbot conversations, a tactic dubbed "Prompt Poaching," and underscores the need for vigilance when installing browser add-ons, especially those requesting broad permissions under the guise of analytics or enhanced user experience.
Jun 29, 2026
Microsoft reported a campaign of **malicious Chromium-based browser extensions** masquerading as legitimate AI assistant tools to **harvest LLM chat histories and browsing data**, with reporting suggesting ~**900,000 installs** and Microsoft Defender telemetry indicating activity across **20,000+ enterprise tenants**. The extensions collected full URLs and chat content from services including **ChatGPT** and **DeepSeek**, creating a high-risk data leakage path for proprietary code, internal workflows, and strategic discussions; Microsoft also noted cases where “agentic” browsers auto-downloaded these extensions, reducing user friction and increasing exposure. Separately, Socket documented a **fake imToken** Chrome extension (`bbhaganppipihlhjgaaeeeefbaoihcgi`) that posed as a benign “hex color visualizer” but functioned as a **phishing redirector**: on install and on click it opened attacker-controlled pages, pulling a destination URL from `jsonkeeper[.]com/b/KUWNE` and sending victims to `chroomewedbstorre-detail-extension[.]com` to solicit **12/24-word seed phrases** or **private keys** for wallet takeover. A Kaspersky post focused on consumer guidance for disabling unwanted AI features and broadly warned about privacy/security risks from pervasive AI assistants (including mention of insecure third-party “personal agent” setups), but it did not provide corroborated details tied to the specific malicious-extension campaigns described by Microsoft and Socket.
Jun 29, 2026