Malicious Browser Extensions Target AI Chatbot Users

Key Takeaways

• Malicious Google Chrome extensions are actively siphoning off user conversations from popular AI platforms like ChatGPT, Claude, Copilot, Gemini, and DeepSeek.
• Three specific extensions identified by G Data analysts — Urban VPN, Smart Sidebar (ChatGPT, Claude, and DeepSeek), and AI Assistant (now Chat AI) — were found to be engaged in this data exfiltration.
• These extensions use stealthy methods, including script injection and hidden iframes, to intercept sensitive user data, including personal details, confidential business information, and medical data, which can be weaponized for various illicit activities.
• The affected extensions often had high ratings and large user bases on the Chrome Web Store, lending them an undeserved sense of legitimacy.

AI Chatbot Users Targeted by Malicious Browser Extensions

A disturbing trend has emerged where malicious Google Chrome extensions are covertly capturing sensitive conversations from users interacting with leading AI platforms such as ChatGPT, Claude, Copilot, Gemini, and DeepSeek. These rogue add-ons, often masquerading as tools to enhance AI interactions, are secretly transmitting user data to unknown external servers, exploiting the trust users place in their AI assistants.

The scope of this issue is substantial. According to Chrome Statistics 2026, AI-related Chrome extensions had amassed approximately 115 million users globally by March 2026. This vast user base presents an attractive target for cybercriminals seeking to acquire valuable data with minimal effort and without drawing immediate suspicion.

G Data Uncovers Covert Data Collection

Security researchers at G Data published a report, shared with Cyber Security News (CSN), detailing three particular extensions involved in this scheme: Urban VPN, Smart Sidebar: ChatGPT, Claude and DeepSeek, and AI Assistant, which has since been rebranded as Chat AI. These extensions had garnered positive reviews and significant download counts on the Chrome Web Store, creating a facade of trustworthiness while their true malicious functionalities operated in the background.

The danger inherent in this campaign stems from the nature of the information being compromised. Users frequently engage AI platforms with highly personal details, proprietary business data, and even medical information. The unauthorized interception of these conversations grants attackers access to material that can be readily leveraged for financial fraud, blackmail, or corporate espionage.

The operational methodology of these extensions is sophisticated. They inject scripts into the browser environment, intercepting outgoing network requests and exfiltrating conversation data before it reaches the legitimate AI service. Victims typically remain unaware of the compromise, as the AI platforms continue to function normally, exhibiting no visible signs of interference.

Malicious Browser Add-Ons: A Closer Look

Urban VPN stands out as the most widely recognized of the identified extensions. Despite being promoted as a free, privacy-focused tool with a 4.7-star rating, version 5.10.3 contained a concealed JavaScript file named “content.js.” This script was designed to target and collect conversations across eight different AI platforms, including ChatGPT, Claude, Copilot, Gemini, and DeepSeek. The data collection occurred persistently in the background, irrespective of whether the VPN functionality was active.

This extension specifically injected an executor script to intercept network requests at their origin, rerouting data through its own malicious code. Smart Sidebar employed a similar tactic. In version 1.9.6, it embedded a file called “aiResponder.js” within a directory named “gptprocessor.” This file monitored user interactions with ChatGPT and DeepSeek, capturing every chat exchange as it happened.

The data harvested by Smart Sidebar was Base64 encoded and transmitted via a POST request to the domain “deepaichats[.]com,” a domain already flagged by numerous security vendors on VirusTotal. The encoded payload contained crucial information, including the unique chat ID, the specific AI platform used, a timestamp, and the complete transcript of the conversation, thereby creating an exhaustive record of all user input and AI responses.

iFrame Injection and the Chat AI Threat

The third identified extension, AI Assistant, now known as Chat AI, utilized a distinct but equally concerning method. Despite being awarded a “Featured” badge by the Chrome Web Store and boasting over 70,000 users, version 3.3.4 embedded a remotely loaded chat interface within a hidden iframe. It then extracted user preferences from browser storage and forwarded this data through a messaging system to a newly registered, unverified external URL.

This iframe injection technique allowed the extension to act as an intermediary between the user and the AI platform, silently observing all communications. Because the injected interface mirrored the legitimate AI assistant’s appearance and behavior, users had no reason to suspect any malicious activity.

What You Should Do

• Install extensions from trusted sources: Only download and install browser extensions from official stores and developers with established reputations.
• Apply the Principle of Least Privilege: Scrutinize the permissions requested by extensions. Grant only the minimum necessary permissions for an extension to perform its stated function.
• Regularly review installed extensions: Periodically audit your browser’s installed extensions and remove any that are no longer needed or that request excessive permissions.
• Enforce organizational policies: For enterprises, administrators should implement group policies to restrict browser extensions from accessing sensitive platforms, particularly AI tools and other critical web applications.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.