NewsPublished 7 Jan 2026

Chrome Extensions With 900,000 Downloads Caught Stealing AI Chats

Source SecurityWeek

Description

Impersonating a legitimate extension from AITOPIA, the two malicious extensions were also exfiltrating users’ browser activity. The post Chrome Extensions With 900,000 Downloads Caught Stealing AI Chats appeared first on SecurityWeek .

Impact

For European organizations, the primary impact is the unauthorized disclosure of sensitive AI chat data and browsing activity, which can include confidential business information, intellectual property, or personal data protected under GDPR. This data leakage can lead to reputational damage, regulatory penalties, and potential exploitation by threat actors for further attacks such as social engineering or corporate espionage. The widespread adoption of Chrome and increasing use of AI chat services in Europe amplify the risk. Organizations relying on AI tools for customer service, research, or internal communications may face operational disruptions if trust in these tools erodes. Additionally, the exfiltration of browsing activity can reveal user behavior patterns and access to internal resources, increasing the attack surface. While no direct active exploitation is reported, the presence of such extensions in enterprise environments could facilitate persistent data theft and undermine compliance efforts.

Defensive guidance

1. Immediately audit and remove the identified malicious Chrome extensions from all organizational devices. 2. Implement strict extension management policies via enterprise browser management tools to whitelist approved extensions only. 3. Conduct user awareness training emphasizing the risks of installing unverified browser extensions, especially those impersonating legitimate tools. 4. Monitor network traffic for unusual outbound connections that may indicate data exfiltration attempts from browser processes. 5. Employ endpoint detection and response (EDR) solutions capable of detecting suspicious browser behaviors and script injections. 6. Collaborate with IT and security teams to review AI chat tool usage policies and restrict sensitive data sharing through browser-based AI interfaces. 7. Encourage reporting and rapid response protocols for suspicious extension activity. 8. Engage with browser vendors and security communities to stay updated on emerging threats related to extensions.

References

securityweek.com/chrome-extensions-with-900000-downloads-caught-stealing-ai-chats/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 7 Jan 2026, 15:11 UTC

References

Community reviews