Extension Banned for Stealing AI Chats Returns to Chrome Store, Resumes Malicious Activities

Summary

A Chrome extension previously removed for stealing AI conversations has reappeared on the Chrome Web Store. Initially flagged for scraping ChatGPT and DeepSeek data, the extension now employs a monetization scheme that triggers affiliate link clicks on update or uninstall events, routing users to an AI video-generation platform. Security researchers warn that the same distribution channel could be used for more harmful payloads in the future.

Full text

A Chrome extension that Google pulled from its store in January 2026 over conversation-theft allegations is back in circulation and reaching enterprise browsers again through Google’s own CRX distribution infrastructure, according to Netskope Threat Labs. The extension is named ‘AI Sidebar with DeepSeek, ChatGPT, Claude and more’ and is advertised as an AI assistant for Chrome. OX Security flagged it in December 2025 for scraping ChatGPT and DeepSeek conversation content and sending it to external domains. Prior to its removal, the extension amassed over 300,000 installs and a 4.6-star rating on the Chrome Web Store. The malicious behavior disappeared from later builds, and the extension’s privacy policy now references the earlier conduct. But the reprieve was temporary. As of August 2026, the extension is active on the Chrome Web Store again, and Netskope says enterprise endpoints are currently receiving updates carrying a different kind of payload. Version 1.7.2.0, distributed between July 20 and 31, 2026, shipped clean functionality, seemingly designed to establish a trustworthy update history. Version 1.7.3.0 followed roughly two weeks later with what Netskope describes as a surgical 21-line addition to a single script file. That addition builds a monetization scheme around update and uninstall events. When Chrome reports that the extension has updated, a service worker opens an affiliate link in a new foreground tab. The link routes through a URL shortener to an AI video-generation platform running a public affiliate program. Code comments specify that the trigger should fire on update rather than install, which turns every future release into a fresh commission rather than a single one-time payout. The uninstall path exploits a Chrome quirk where only the most recently registered uninstall URL fires. The operators overwrite the legitimate code’s URL five seconds after it loads, ensuring that users who remove the extension still generate a referral on the way out.Advertisement. Scroll to continue reading. Attribution points to a company called Extchange.com, listed in the extension’s own files as both developer and data controller, with a domain registered in February 2024 and no public registrant information. The Chrome Web Store listing falsely shows the developer name as DeepSeek AI. Netskope says it detected and blocked version 1.7.3.0 arriving at enterprise endpoints via Google’s CDN, classifying it as Trojan.GenericFCA.Script.37952. The company reported the extension to the Chrome Web Store before publishing its findings and is advising organizations to remove it. Netskope frames the affiliate scheme itself as low-stakes compared with what made the case notable. However, the security firm warned that the same channel could just as easily carry a more damaging payload next time. Related: Critical Flaws Discovered in Belgian eID Software Used by 2 Million People Related: ‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad Related: CISA Urges Immediate Patching of Exploited Progress LoadMaster Vulnerability Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs New Jersey, Alabama Join States Targeted in Water CyberattacksNovel Private APN Pivot Let Hackers Sabotage Second Polish Energy FacilityCritical Flaws Discovered in Belgian eID Software Used by 2 Million PeopleCritical One-Click Vulnerability in Atlassian’s Rovo AI Exposed Enterprise DataTruck Brake Controller’s Safety Recall Doubled as Hidden Security FixSnowflake Hacker Pleads Guilty in US CourtZero-Click AI Browser Hacking: Claude and ChatGPT Atlas Hijacked via Emails, X PostsMeta AI Hacked External Systems During Cybersecurity Testing Latest News Corma Raises $60 Million for Defensive Cybersecurity AI ModelHacker Conversations: Marcus Hutchins and the Journey From the Gray Zone to RedemptionOpenAI Unveils New Cybersecurity Model GPT-5.6-CyberMozilla Issues New Firefox GPG Key Following ExposureOpenAI’s Upcoming Astra Model Raises Autonomous Cyberattack ConcernsStealthium Targets Security Blind Spots in AI Accelerators and Neo-CloudsCisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the Move1Kosmos has named Frank Cohen Chief Revenue Officer.ServiceNow has appointed Simon Mouyal as Chief Marketing Officer.James Wilkinson has been named Chief Information Security Officer for the City of Dallas.More People On The MoveExpert Insights Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts. (Tod Beardsley) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• malware — Trojan.GenericFCA.Script.37952

Entities