Security researchers have uncovered 18 Chrome browser extensions that pose as helpful AI tools but secretly steal users' emails, ChatGPT prompts, and passwords. Unit 42 researchers at Palo Alto Networks, including Shresta Bellary Seetharam, Nabeel Mohamed, Billy Melicher, Oleksii Starov, Qinge Xie, and Fang Liu, found that these extensions advertise generative AI ("GenAI") productivity features as bait, then install malware that spies on what you type. Google has since removed the extensions or warned the publishers behind them.
What's affected
Anyone who installed one of the 18 extensions in Chrome (and, by extension, similar Chromium-based browsers such as Edge) is at risk. Because the add-ons request unusually broad permissions, they can read everything happening inside services like Gmail, Outlook, and ChatGPT once you are signed in. The researchers grouped the campaigns into six malware types: remote access trojans (RATs, which give an attacker remote control of the browser), adversary-in-the-browser implants that sit between you and the websites you visit, infostealers, search and prompt hijackers, brand impersonators, and spyware.
How the attack works
Each extension uses an AI feature as the hook to obtain wide permissions, then abuses its trusted spot inside the browser to capture data before it is encrypted or after it is decrypted. The implants read decrypted HTTPS responses, override the browser's window.fetch and XMLHttpRequest functions, or watch the page (the DOM) in real time as you type.
One example, Chrome MCP Server, AI Browser Control (extension ID fpeabamapgecnidibdmjoepaiehokgda, SHA-256 0cbf101e96f6d5c4146812f07105f8b89bd76dd994f540470cd1c4bc37df37d5), is marketed as a Model Context Protocol automation helper but is actually a full RAT. It connects to an attacker server (a WebSocket "command and control" channel) at wss://mcp-browser.qubecare[.]ai/chrome and accepts more than 30 commands, including running arbitrary code, attaching the Chrome Debugger to read decrypted HTTPS traffic, taking screenshots, and auto-filling forms on whatever sites the victim is logged into.
Another, Supersonic AI (extension ID eebihieclccoidddmjcencomodomdoei, SHA-256 ac0a312398b3bf6b3d7c5169687ca72f361838bc5a90f2c0dbce2dc8e2094a02), promises one-click Gmail and Outlook AI replies but sends the full text of every email you read, send, or view to an outside server in plain text, including one-time passcodes delivered by email. Other samples include a "Reverse Recruiting" infostealer that targets job-application data, hijackers that redirect AI queries to attacker domains, and a proxy abuser that routes selected traffic through hxxps://yiban[.]io/extension/proxy[.]pac?t=huiyi.
The researchers flagged six recurring tricks: persistent server connections hidden inside HTTPS, hooking browser network functions before data is encrypted, stealing data straight from the page so nothing shows up on the network at collection time, dynamic remote scripts that decide which traffic to intercept, persistence that recreates deleted tracking identifiers, and abuse of a one-time install event to run code at setup. Several samples contained AI-generated source code, which Unit 42 says (with moderate confidence) suggests the operators used large language models to speed up building the malware.
What you should do
The risk is high because intercepting AI prompts can expose proprietary code, draft communications, deal strategy, and customer data, and the Chrome Web Store review process struggles to tell a real AI assistant apart from a malicious one asking for the same permissions. Treat installing an extension as a privileged action: audit your current Chrome and Edge add-ons against the indicators below, only install extensions from trusted publishers, and enforce least-privilege permission rules through managed browser settings.
Sample indicators of compromise (defanged):
- SHA-256: 604c7aef72892b56ac23ad54744376574239c8f0651e95dd5b6cf540eb70f7c3
- SHA-256: dfe307d957724ebe32331f92d53e366b7fa85968a9564c2285c5a0142ac9e1bb
- SHA-256: 4e38bee33237a8c8b17a2504013e506ca7cbf667a7f68a2d94d75db505c2149f
- SHA-256: c9754454efede2dec2fcb856faa40424b8df378706b664a5ae4847fcd0336b53
- PAC URL: hxxps://yiban[.]io/extension/proxy[.]pac?t=huiyi
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.