Malicious Chrome Extensions Pose as AI Tools to Steal User Data
More than 260,000 Chrome users fell victim to a coordinated campaign involving 30 fraudulent browser extensions disguised as AI assistants. These extensions, which mimicked popular services like ChatGPT and Gemini, secretly harvested sensitive browsing and email data while posing as productivity tools.
The attackers employed a technique called 'extension spraying,' flooding the Chrome Web Store with near-identical variants to evade detection. Several even gained featured placement, lending them an air of legitimacy. Researchers at LayerX found all shared identical underlying code, despite varying names and logos, funneling data to the same hidden servers.
The scheme capitalized on surging interest in AI utilities, with victims believing they were installing helpful chatbots or content summarizers. Instead, the extensions requested broad permissions to operate undetected while exfiltrating information.
