Malicious AI-Mimicking Chrome Extensions Steal Data from 300,000 Users

Cybersecurity researchers at LayerX have uncovered a coordinated campaign involving more than 30 malicious Google Chrome extensions that impersonate popular AI assistants, affecting over 300,000 users worldwide. Posing as productivity tools in the Chrome Web Store, these extensions secretly harvest sensitive data such as emails, login credentials, and browsing activity, according to the firm's analysis released this week.

The extensions, part of what LayerX has dubbed the AiFrame operation, mimic legitimate AI services like ChatGPT, Google Gemini, and Anthropic's Claude. They gained traction by appearing as convenient sidebar assistants or translators, with some even featured prominently in the Web Store to build trust. In total, the add-ons have racked up hundreds of thousands of installations since their publication, though exact timelines remain unclear.

At their core, the extensions function by rendering a fullscreen iframe that overlays the user's current webpage and loads content from remote servers controlled by the attackers. This design allows the malicious code to operate outside the Chrome Web Store's review process, enabling developers to alter behavior dynamically...