Fake AI Chrome Extensions Steal 900K Users' Data

Fake AI Chrome extensions have been found to steal data from hundreds of thousands of users by mimicking legitimate extensions from a company called AItopia. According to Ox Security, two malicious extensions copied the functionality of a legitimate app and exfiltrated complete conversation content from ChatGPT and DeepSeek sessions to a command-and-control server; one extension had more than 600,000 users and a Google Chrome Featured badge, while the other exceeded 300,000.

The total count of affected users exceeded 900,000 before both extensions were removed, and researchers noted that the campaign collected AI conversations and browser data, including complete URLs from all Chrome tabs, search queries, and internal corporate URLs. The blog described the data as potentially weaponisable for corporate espionage, identity theft, or targeted phishing, with organisations whose employees installed the extensions potentially exposing intellectual property and confidential information.

Ox Security recommends removing the extensions immediately and advises avoiding installations from unknown sources, even if tagged as Featured in Chrome’s extension store.