A newly discovered data-collection operation, PromptSnatcher, is secretly intercepting the private AI conversations of approximately 90,000 browser users.
Operating under the guise of two malicious ad-blocking extensions, the campaign captures sensitive chat logs, account metadata, and model usage from eight major AI platforms while maintaining a completely legitimate appearance.
The operation, internally tracked as Panel 231, successfully targets ChatGPT, Claude, Gemini, Copilot, Perplexity, DeepSeek, Grok, and Meta AI.
To evade automated storefront scanners and user suspicion, the developers integrated legitimate public filter lists like EasyList and “I Don’t Care About Cookies.”
This provides genuine ad-blocking utility while serving as functional cover for an undisclosed telemetry channel.
Users are tricked into accepting this surveillance through a misleading onboarding screen that requests consent for generic “Enhanced Protection” without ever mentioning AI chat collection.
Ad Blockers Steal AI Chats
Forensic analysis reveals that the two extensions share identical obfuscated code and a custom-built background manager. They inject a shared JavaScript file directly into the main page environment to quietly monitor user activity across targeted AI domains.
Once injected, the capture engine patches core web communication protocols to clone traffic in real time. It hooks into global data retrieval commands, specifically targeting the fetch, XMLHttpRequest, and WebSocket constructors.
The extensions buffer this captured text, holding up to 10,000 characters for user prompts and 30,000 characters for AI responses before transmitting the payload.
The developers built custom parsers for each platform to extract these sensitive account details.
For example, the extension actively scrapes the ChatGPT interface to determine whether the user has a paid account, and it probes Microsoft Copilot to check for active Pro-tier subscriptions.
One of the most dangerous features of PromptSnatcher is its dynamic payload management.
Instead of hardcoding the platform parsing logic into the extension files, the background manager downloads its targeting rules from a remote configuration endpoint at runtime, malext said.
This flexible architecture allows the threat actors to silently add new AI platforms or update their parsing rules without submitting a new version to browser extension stores for review.
While Meta AI is completely absent from the extension’s static code, it was found active and enabled in the live remote configuration.
The command-and-control servers protect this ruleset by requiring specific browser extension origin headers, effectively hiding the malicious payload from standard web security scanners.
Furthermore, the operation actively extends storefronts to bypass privacy checks. The Firefox variants of both extensions explicitly declare in their manifests that they require zero data collection permissions.
Despite this official declaration, they ship with a capture engine that is functionally identical to the highly intrusive Chrome variants.
This campaign highlights the growing supply chain risks associated with browser extensions.
By offering legitimate functionality while hiding dynamic, remotely updatable spyware, threat actors can easily bypass automated store checks to harvest highly sensitive personal and corporate data from modern AI platforms.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
