Malicious Chrome Extensions Exfiltrate ChatGPT & DeepSeek Data

Du'aine Davis

Observed in the wild

• On 30 December, OX Security identified a malware campaign involving two malicious Chrome extensions impersonating AITOPIA’s legitimate AI sidebar. Over 900,000 users were affected, with stolen ChatGPT and DeepSeek conversations, browsing history, and sensitive corporate data exfiltrated to attacker-controlled servers every 30 minutes. Despite containing data-stealing malware, one extension carried Google’s “Featured” badge, increasing trust and downloads.
• Threat actors cloned AITOPIA’s extension, adding hidden exfiltration capabilities. The malware exploited Chrome’s “read all website content” permissions to capture prompts, responses, and URLs, storing them locally before sending to C2 servers. They used Lovable, an AI-powered platform, to host privacy policies and redirect pages, anonymising infrastructure and complicating attribution. Extensions also tricked users into reinstalling variants upon removal.
• Organisations should immediately remove the extensions via chrome://extensions or the Chrome Web Store. Avoid installing extensions from unknown sources, even if “Featured.” Monitor for suspicious behaviour such as repeated Chrome extension prompts, unexpected network traffic to C2 domains, and unauthorised data access.

Malicious Chrome Extensions Steal ChatGPT Conversations

Du'aine Davis

ShadowPrompt Vulnerability in Claude Chrome Extension
Observed in the wild

• On 26 March, Koi Security disclosed “ShadowPrompt”, a chained vulnerability allowing any website to silently take control of Anthropic’s Claude Chrome extension, which has over three million users. Simply visiting a malicious page could result in full browser‑level abuse via Claude, including access to Gmail, Google Drive, and user data, without clicks or user interaction.
• The attack chained two flaws: an overly permissive extension allowlist trusting all *.claude.ai origins, and a DOM‑based XSS in an outdated Arkose Labs CAPTCHA hosted on a‑cdn.claude.ai. Exploiting postMessage origin checks and unsafe HTML rendering allowed attackers to inject arbitrary prompts into Claude via the extension’s messaging API, effectively impersonating the user.
• Organisations are advised to ensure Claude extension version 1.0.41 or later is enforced, restrict or remove high‑privilege AI extensions, and monitor browser behaviour for abnormal background tab creation or scripted interactions. Using Microsoft Defender for Endpoint, teams should audit installed extensions, alert on suspicious browser–extension messaging patterns, and apply attack surface reduction rules to limit abuse of browser automation capabilities

ShadowPrompt: How Any Website Could Have Hijacked Claude's Chrome Extension