NewsPublished 11 Aug 2026

Extension Banned for Stealing AI Chats Returns to Chrome Store, Resumes Malicious Activities

Source SecurityWeek

Description

The extension amassed over 300,000 installs and a 4.6 rating before Google removed it for stealing data. The post Extension Banned for Stealing AI Chats Returns to Chrome Store, Resumes Malicious Activities appeared first on SecurityWeek .

Impact

The extension compromises user privacy by initially stealing AI chat conversations. Its current payload generates unauthorized affiliate revenue by opening affiliate links on update and uninstall events, potentially exposing users to unwanted web traffic and tracking. The malicious code is distributed through Google's official Chrome Web Store infrastructure, increasing the risk of widespread deployment, including on enterprise endpoints. While the current affiliate scheme is low-stakes, the channel could be used to deliver more harmful payloads in the future.

Defensive guidance

Organizations and users should remove the 'AI Sidebar with DeepSeek, ChatGPT, Claude and more' extension from all browsers immediately. Security teams should monitor for its presence on endpoints and block related network traffic if possible. Since the extension is distributed via the Chrome Web Store, users should be cautious about reinstalling it. Vendors and administrators should stay alert for updates or similar malicious extensions appearing in the store.

Summary

The Chrome extension 'AI Sidebar with DeepSeek, ChatGPT, Claude and more' was initially banned for scraping and stealing conversation data from AI services like ChatGPT and DeepSeek. It amassed significant user adoption before Google removed it in January 2026. The extension later reappeared on the Chrome Web Store with a clean update history to build trust, but subsequent versions introduced a monetization scheme exploiting update and uninstall events to open affiliate links, generating referral commissions. This behavior was detected and blocked by Netskope Threat Labs, which classified the latest version as Trojan.GenericFCA.Script.37952. The extension is distributed via Google's CRX infrastructure and remains active on enterprise endpoints. The developer is listed as Extchange.com, with misleading developer information on the Chrome Store. Netskope recommends removal due to the extension's malicious activities and warns that future updates could carry more damaging payloads.

References

securityweek.com/extension-banned-for-stealing-ai-chats-returns-to-chrome-store-resumes-malicious-activities/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 11 Aug 2026, 11:26 UTC

References

Community reviews