Artificial Intelligence has rapidly evolved from a niche technology into a daily necessity for millions of internet users. As professionals increasingly rely on agentic AI to manage schedules and draft communications, a massive ecosystem of browser extensions has emerged.
As of March 2026, AI-related Google Chrome extensions boast an estimated 115 million users. Unfortunately, threat actors are aggressively exploiting this trend by disguising malicious data stealers as helpful productivity tools.
Many users implicitly trust AI platforms, freely sharing confidential company data, proprietary source code, and deeply personal medical information.
When a rogue browser add-on intercepts these interactions, it captures highly sensitive data that can be leveraged for extortion or corporate espionage.
Security researchers have recently identified several popular Chrome extensions that actively siphon conversations from platforms like ChatGPT, Claude, Copilot, Gemini, and DeepSeek.
Malicious Add-Ons Target AI
Urban VPN is marketed as a free, privacy-focused tool that encrypts network traffic. Despite maintaining a 4.7-star rating on the Chrome Web Store, version 5.10.3 harbors a malicious JavaScript file named “content.js” that targets major AI platforms.
This script runs continuously in the background, regardless of whether the VPN connection is active. When a user visits an AI chatbot, the extension injects an executor script that overrides standard network requests.
This forces all outgoing prompts and incoming AI responses to pass directly through the attacker’s code before reaching the legitimate platform.
Smart Sidebar presents itself as an integrated assistant for browsing and coding, amassing over 400,000 users. However, version 1.9.6 actively steals data from ChatGPT and DeepSeek using a concealed script called “aiResponder.js”.
The malware uses a Document Object Model (DOM) watcher to detect new chat elements and waits for the AI response to fully render.
It then extracts the user input, Base64-encodes the entire conversation array, and covertly transmits the payload via a POST request to a malicious remote server.
Chat AI, formerly known as AI Assistant, impacts over 70,000 users and has even earned a featured badge in the Chrome Web Store. Beneath its sleek interface, version 3.3.4 operates using a deceptive React-based component.
The extension embeds a remote chat interface inside an iframe and relies on local storage to track user preferences.
It then communicates these details back to an attacker-controlled domain, creating a silent overlay that monitors interactions without triggering standard browser security warnings, gdatasoftware said.
Indicators of Compromise
| Extension Name | File Name | SHA256 Hash | Extension ID | Detection Name |
|---|---|---|---|---|
| Urban VPN | content.js | 524C953E23FF8B768206CF33A529C11AC5510E47CBF6246DB79EE671D1231716 | eppiocemhmnlbhjplcgkofciiegomcon | Script.Trojan-Stealer.AIStealer.08LJNB |
| Smart Sidebar | aiResponder.js | C984787CCD787629542DA68302ED4CEB48FC7E458EAB1C15BF45C3070883D26A | fnmihdojmnkclgjpcoonokmkhjpjechg | Script.Trojan-Stealer.AIStealer.8HGRSW |
| Chat AI / AI Assistant | index.js | F8CBE44FDE6914BC8D06426C03C92ED536C891470292E567A586B54AF29C2442 | fnmihdojmnkclgjpcoonokmkhjpjechg | Script.Trojan.AiFrame.703FYD |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
