Two Chrome Extensions Caught Stealing AI Chats from 900,000 ChatGPT and DeepSeek Users

Malicious Chrome Extensions Target AI Users

Cybersecurity researchers at OX Security have identified two malicious Chrome extensions collectively installed by more than 900,000 users that were designed to steal AI chats and browsing data1

1

. The extensions, named "Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI" and "AI Sidebar with Deepseek, ChatGPT, Claude, and more," impersonate a legitimate extension from AITOPIA that has approximately 1 million users2

2

. The first extension had garnered over 600,000 users and carried a Featured badge, while the second appeared verified with 300,000 users3

3

.

How the Data Exfiltration Works

According to OX Security researcher Moshe Siman Tov Bustan, the extensions "were found exfiltrating user conversations and all Chrome tab URLs to a remote C2 server every 30 minutes"1

1

. The malware operates by requesting consent for "anonymous, non-identifiable analytics data" to supposedly improve the sidebar experience, while actually stealing user conversations from ChatGPT and DeepSeek sessions2

2

. Once users grant permission, the rogue extensions begin harvesting information by searching for specific DOM elements inside web pages, extracting chat messages, and storing them locally before transmitting to remote servers at "chatsaigpt[.]com" or "deepaichats[.]com"1

1

. Threat actors leveraged Lovable, an AI-powered web development platform, to host their privacy policies and infrastructure components in an attempt to obfuscate their actions3

3

.

Prompt Poaching Emerges as Growing Threat

This tactic of using browser extensions to stealthily capture AI conversations has been codenamed Prompt Poaching by Secure Annex1

1

. The practice follows similar discoveries, including Urban VPN Proxy—an extension with millions of installations on Google Chrome and Microsoft Edge that was caught spying on users' AI chatbot conversations2

2

. Secure Annex also identified legitimate browser extensions such as Similarweb and Sensor Tower's Stayfocusd, with 1 million and 600,000 users respectively, engaging in stealing chat logs1

1

. Similarweb introduced the ability to monitor AI chatbot conversations in May 2025, with a January 1, 2026 update adding a terms of service pop-up explicitly stating that data entered into AI tools is collected1

1

.

Corporate Espionage and Identity Theft Risks

The consequences of installing such malicious Chrome extensions can be severe for both individuals and organizations. The stolen data includes sensitive information shared with chatbots like ChatGPT and DeepSeek, web browsing activity, search queries, internal corporate URLs, session tokens, user IDs, and authentication data3

3

. "This data can be weaponized for corporate espionage, identity theft, targeted phishing campaigns, or sold on underground forums," OX Security warned1

1

. Organizations whose employees installed these extensions may have unknowingly exposed intellectual property, customer data, and confidential business information to threat actors1

1

. Researchers also discovered that if users uninstalled one extension, the other would open in a new tab attempting to trick users into installing the alternative3

3

.

Browser Security Concerns Mount

What makes Prompt Poaching particularly worrisome is that most of these extensions were found on the Chrome Web Store, with some even earning Featured and Verified badges2

2

. As of the initial reporting, the extensions were still available for download, though "Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI" had been stripped of its Featured badge1

1

. Users should navigate to chrome://extensions/ to check for and remove the malicious impersonators3

3

. Security experts emphasize that ratings and reviews cannot be blindly trusted, as some threat actors convert legitimate extensions to malware years after launch. Users should vet extensions carefully for red flags, research developers on platforms like Google and Reddit, and regularly audit installed extensions to minimize risk to user privacy3

3

. The emergence of Prompt Poaching targeting popular AI services like Claude and Gemini signals that threat actors are adapting their tactics to exploit the growing reliance on AI chatbot conversations for both personal and professional use.