Security Boulevard reports that more than 900,000 Google Chrome users have had their conversations with AI chatbots ChatGPT and DeepSeek stolen via malicious extensions impersonating an add-on by AITOPIA, which places a sidebar for chatting with large language models.
Installation of the "Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI" and "AI Sidebar with Deepseek, ChatGPT, Claude and more" extensions allows the exfiltration of user conversations that include source code, personally identifiable information, and corporate data, as well as Chrome tab URLs to an attacker-controlled command-and-control server every half hour, an analysis from OX Security revealed.
"This data can be weaponized for corporate espionage, identity theft, targeted phishing campaigns, or sold on underground forums. Organizations whose employees installed these extensions may have unknowingly exposed intellectual property, customer data, and confidential business information," said OX Security researchers.
Additional findings revealed that malicious activity persists even after removing one of the extensions by opening the other in a separate Chrome tab. Google is already investigating the illicit extensions.
Installation of the "Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI" and "AI Sidebar with Deepseek, ChatGPT, Claude and more" extensions allows the exfiltration of user conversations that include source code, personally identifiable information, and corporate data, as well as Chrome tab URLs to an attacker-controlled command-and-control server every half hour, an analysis from OX Security revealed.
"This data can be weaponized for corporate espionage, identity theft, targeted phishing campaigns, or sold on underground forums. Organizations whose employees installed these extensions may have unknowingly exposed intellectual property, customer data, and confidential business information," said OX Security researchers.
Additional findings revealed that malicious activity persists even after removing one of the extensions by opening the other in a separate Chrome tab. Google is already investigating the illicit extensions.
