PromptSnatcher: AdBlocker stealing Ai Chats · 90k installs
Source Reddit NetSec
Discussion
PromptSnatcher is a malicious data collection operation involving two Chrome browser extensions masquerading as ad blockers with approximately 90,000 combined installs. These extensions intercept full conversation histories, model usage, and subscription tier information from eight major AI platforms, including ChatGPT, Claude, Gemini, and others. The exfiltrated data is sent to operator-controlled servers without clear user notification beyond a vague "Enhanced Protection" consent. The extensions dynamically update their parsing logic from remote command-and-control servers, enabling ongoing targeting without extension updates. Firefox variants falsely declare no data collection permissions while performing equivalent data interception. The operation uses distinct infrastructure for each extension and employs sophisticated API hooking to capture and transmit sensitive AI chat data.
r/netsec (opens in a new tab)u/Huge-Skirt-69900 points0 comments
Full write-up: MalExt Sentry - Malicious Browser Extension Tracker
Two Chrome extensions presenting as adblockers also intercept every prompt and response on ChatGPT, Claude, Gemini, Copilot, Grok, Perplexity, DeepSeek, and Meta AI, exfiltrating them to operator-controlled servers.
They also check whether you're a paid user on 5 of the 8 platforms
(ChatGPT, Claude, Perplexity, Copilot, Gemini).
Both share the same capture engine, payload format, and partnerId.
Two brands, one operation.
- Smart Adblocker - Chrome Web Store `
iojpcjjdfhlcbgjnpngcmaojmlokmeii`, 80k users - Adblock for Browser - Chrome Web Store `
jcbjcocinigpbgfpnhlpagidbmlngnnn`, 10k users
Report covers the IOCs, live remote config, reproduction curl, and full target breakdown.
Chrome Web Store abuse reports filed.