Malicious Browser Extension Harvests ChatGPT Conversations

A fake ChatGPT ad blocker extension infiltrated the official Chrome Web Store and harvested users' conversations by cloning DOM elements and exfiltrating data via Discord webhooks. The malicious extension demonstrated sophisticated evasion techniques including remote command updates from GitHub and targeting conversations longer than 150 characters. This supply chain attack highlights the risks of installing unvetted browser extensions, even from official app stores, and the need for users to verify extension legitimacy before installation.

Tactical Insight

Immediate actions

Remove suspicious browser extensions and review installed extensions for legitimacy
Implement browser extension allowlisting policies in enterprise environments
Enable browser security features that warn about potentially malicious downloads

Long-term improvements

Establish vendor vetting procedures for all third-party software including browser extensions
Deploy endpoint detection solutions that monitor browser extension behavior
Create security awareness training focused on supply chain risks and safe browsing practices

Detection measures

Monitor network traffic for unusual data exfiltration patterns to external services
Implement DNS filtering to block known malicious domains associated with extension campaigns