A Chrome extension named 'AI Sidebar with DeepSeek, ChatGPT, Claude and more', previously removed for stealing conversations, has resurfaced on the Chrome Web Store. Initially flagged for scraping content and sending it to external domains, the extension, which amassed over 300,000 installs, returned with altered functionality in August 2026. The new version (1.7.3.0) includes a monetization scheme that redirects update notifications to affiliate links, generating commissions on uninstalls as well.
Netskope detected the malicious behavior and is advising organizations to remove the extension, indicating its potential for delivering more harmful payloads in the future. The developer, linked to an entity called Extchange.com, has obscured its identity.