Loading story…
A Chrome extension marketed as "Prompt Optimizer - SecondBrain" was reported to capture users’ prompts and AI responses across at least nine generative AI platforms, including ChatGPT, Claude, and Gemini, without requiring users to open or interact with the add-on. Researchers said the extension executed at document_start, pulled remote configuration from infrastructure tied to secondbrain.is, stored a local userId and credentials, and transmitted captured conversation data to a vendor ingestion endpoint; the extension was reportedly installed by roughly 100,000 users.
Technical artifacts linked to the extension include a Chrome-style extension ID, browser event handling such as tabs.onUpdated, and network activity through window.fetch and XMLHttpRequest to SecondBrain domains associated with ingestion and optimization services. The reported behavior appeared to conflict with the Chrome Web Store privacy declaration that the developer did not collect or use user data, and the presence of ExtensionInstallBlocklist in related telemetry suggests some enterprise environments may move to block or monitor the extension while its data-collection practices are scrutinized.
Trace attribution and downstream blast radius.
2 events from the most recent confirmed update back to the earliest known activity.
A Reddit post described the Chrome extension "Prompt Optimizer - SecondBrain" as capturing AI prompts and responses across nine AI platforms without the user opening the extension. The author said the behavior was reproduced on a clean browser profile and noted the extension allegedly had about 100,000 users and a Chrome Web Store privacy declaration that appeared to contradict the observed collection.
A new report detailed how the Prompt Optimizer – SecondBrain extension allegedly intercepts browser traffic, scrapes DOM content, and uses keylogging where needed to capture AI conversations, including in Microsoft 365 Copilot environments. The article also published defensive indicators, including extension ID aajjgdpofhhcjmjoombjdfepplndhgcp and the domains ingest.secondbrain.is and optimize.secondbrain.is.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcereddit.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that several AI-themed browser extensions in official marketplaces covertly harvested user conversations from generative AI services including **ChatGPT, Claude, Copilot, Gemini, and DeepSeek**. G Data identified **Urban VPN**, **Smart Sidebar: ChatGPT, Claude and DeepSeek**, and **AI Assistant/Chat AI** as examples that remained outwardly functional while injecting scripts, intercepting requests, tampering with page content, or using hidden iframes to capture prompts and responses from visited AI sites. Investigators said the stolen data included conversation IDs, hostnames, timestamps, and full chat histories, with some payloads encoded in Base64 and sent to external servers. The extensions reportedly had strong ratings, large user bases, and in one case a Chrome Web Store **Featured** badge, underscoring how official store vetting can miss dynamic malicious behavior such as remote iframe communications; researchers warned that AI-focused extensions now expose a broad attack surface and urged enterprises to enforce strict extension allow-listing, minimize permissions, and remove unnecessary add-ons from systems accessing sensitive AI platforms.
Jun 29, 2026
Two rogue Chrome extensions, impersonating the legitimate AITOPIA AI sidebar tool, have compromised over 900,000 users by exfiltrating ChatGPT and DeepSeek conversations along with full browsing histories to attacker-controlled servers. The extensions, named "Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI" and "AI Sidebar with Deepseek, ChatGPT, Claude and more," request consent for "anonymous analytics" but covertly steal sensitive data, including proprietary code, business strategies, PII, and internal URLs. The malware operates by monitoring browser tabs, scraping chat content and session IDs, and sending Base64-encoded data to C2 servers every 30 minutes, exposing users to risks such as espionage, identity theft, and phishing. Researchers from OX Security discovered the threat, noting that the extensions remain available on the Chrome Web Store, with one losing its "Featured" badge after disclosure. The extensions also redirect users to each other if uninstalled, and their privacy policies are hosted on third-party sites to obscure their origins. The incident highlights the growing trend of browser extensions being used to capture AI chatbot conversations, a tactic dubbed "Prompt Poaching," and underscores the need for vigilance when installing browser add-ons, especially those requesting broad permissions under the guise of analytics or enhanced user experience.
Jun 29, 2026
The Urban VPN Proxy Chrome extension, boasting over 6 million installs and a "Featured" badge on the Chrome Web Store, was discovered secretly collecting and exfiltrating user conversations with major AI chatbots, including ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, DeepSeek, Grok, and Meta AI. Researchers found that a silent update in July 2025 (version 5.5.0) introduced hidden code that intercepts every prompt and response exchanged with these AI platforms, along with conversation identifiers, timestamps, and session metadata. The extension, which markets itself as a privacy and security tool, continued to harvest data regardless of whether the VPN service was active, betraying user trust and bypassing normal browser security boundaries. Captured data was sent to Urban VPN’s servers and subsequently sold to marketing analytics firms, notably BiScience, a known data broker. The malicious behavior was enabled by script injection that overrode browser APIs such as `fetch()` and `XMLHttpRequest()`, ensuring all relevant traffic was intercepted. The extension’s widespread distribution and high user ratings, combined with its presence on both Chrome and Edge marketplaces, amplified the impact of this breach. The incident highlights the risks posed by browser extensions with privileged access and the potential for abuse even among highly rated and officially endorsed add-ons.
Jun 29, 2026