PromptSnatcher Ad Blocker Extensions Steal AI Chats

Key Takeaways

• Two browser extensions, “Smart Adblocker” and “Adblock for Browser,” secretly stole private conversations from major AI platforms.
• Approximately 90,000 users were affected across eight AI services, including ChatGPT, Claude, and Gemini.
• The extensions provided legitimate ad-blocking functionality while simultaneously exfiltrating detailed AI chat histories.
• The operation, dubbed “PromptSnatcher,” was sophisticated, employing identical backend infrastructure across different browser stores and actively misleading users about data collection practices.

Malicious Ad Blockers Exposed for Stealing AI Chats

In a sophisticated supply chain attack, two seemingly innocuous browser extensions masquerading as ad blockers have been found to systematically exfiltrate private conversations from prominent artificial intelligence platforms. These malicious extensions, identified as “Smart Adblocker” and “Adblock for Browser,” successfully compromised the AI interactions of an estimated 90,000 users before their clandestine activities were uncovered.

The targeted AI services included industry leaders such as ChatGPT, Claude, Gemini, and five other major platforms. While users benefited from the promised ad-blocking features, their sensitive AI dialogues were silently siphoned off in the background, raising significant privacy and security concerns.

The “PromptSnatcher” Operation: A Deep Dive

Internally tracked as “Panel 231” and named “PromptSnatcher” by researchers, this operation extended far beyond simple data logging. The extensions were meticulously engineered to capture complete conversation histories, accurately identify the specific AI model a user was interacting with, and even ascertain whether the user held a paid subscription tier. The granular nature of the collected data points to a well-resourced and commercially motivated campaign behind the illicit data acquisition, as detailed in a comprehensive report by analysts at MalExt Sentry.

The discovery originated from an automated scanner that flagged a recurring Google Tag Manager ID across several extensions. This seemingly minor discrepancy in filter rules ultimately unraveled a broader conspiracy, linking two distinct extensions to a unified, hidden data collection engine.

Despite being published under different names and pointing to separate domains, “Smart Adblocker” (Chrome ID: iojpcjjdfhlcbjnpngcmaojmlokmeii, C2 domain: smartadblocker.com) and “Adblock for Browser” (Chrome ID: jcbjcocinigpbgfpnhlpagidbmlngnnn, C2 domain: abforbrowser.com) shared identical backend code, infrastructure, and an internal communication protocol designated LDP_MESSAGE. This dual-deployment strategy is a recognized tactic employed by threat actors to expand their reach and mitigate the impact of a single takedown, thereby prolonging the campaign’s lifespan.

A key factor contributing to PromptSnatcher’s elusive nature was its reliance on legitimate, publicly available ad-blocking filter lists, such as EasyList. This integration provided the extensions with genuine functionality, allowing them to pass superficial inspections. Crucially, the malicious telemetry engine operated entirely independently from the ad-blocking components, rendering the covert data exfiltration layer exceptionally difficult to detect without in-depth code analysis.

How the Data Theft Unfolded

The core of the attack leveraged a script named shared-page-capture.js, which was injected directly into the active web page. Once deployed, this script intercepted all network traffic by patching global browser functions including fetch, XMLHttpRequest, and WebSocket. This insidious mechanism ensured that every message exchanged with an AI chatbot was routed through the malicious code before it ever reached the user’s interface.

Captured conversations were buffered, with prompts up to 10,000 characters and responses up to 30,000 characters, before being transmitted to operator-controlled servers. Each data exfiltration package contained a unique device ID, the AI platform name, the conversation ID, the specific AI model used, the user’s subscription tier, and a timestamp. This comprehensive data collection suggests a clear intent for resale of the stolen information or the creation of detailed profiles of AI users.

The scope of the attack encompassed eight major AI platforms: ChatGPT, Gemini, Claude, Copilot, Perplexity, DeepSeek, Grok, and Meta AI. The attackers possessed the capability to remotely add new targets via a configuration server, eliminating the need for extension updates. Notably, Meta AI was not even present in the static extension code but was already actively targeted through the live remote configuration, demonstrating the adaptability of the operation.

The Disclosure Gap That Made It Worse

A particularly concerning aspect of the PromptSnatcher operation involved the Firefox versions of both extensions. Their manifest files explicitly declared data_collection_permissions: none, formally assuring users and Mozilla that no data collection was occurring. Despite this explicit declaration, the underlying code was functionally identical to their Chrome counterparts, which performed full conversation capture. This direct contradiction between stated policy and actual functionality severely compromised user trust in the Firefox review process.

Furthermore, the onboarding process for these extensions employed vague language such as “Enhanced Protection,” deliberately omitting any mention of AI conversation recording. Users who believed they were simply installing a standard ad blocker had no reasonable means of discerning the true nature of the extensions’ activities.

What You Should Do

• Immediately Uninstall: Remove “Smart Adblocker” and “Adblock for Browser” extensions from all browsers (Chrome, Firefox, etc.) without delay.
• Change AI Account Credentials: As a precautionary measure, change passwords and review security settings for all AI platforms you have used, especially ChatGPT, Gemini, and Claude.
• Review Conversation History: Scrutinize your recent conversation history on affected AI platforms for any unusual activity or signs of unauthorized access.
• Exercise Caution with Extensions: Be extremely vigilant when installing browser extensions. Only download extensions from reputable developers and carefully review requested permissions and user reviews.
• Utilize Security Software: Ensure your operating system and security software are up-to-date to detect and prevent malicious software.

Indicators of Compromise (IoCs):-

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.