In August, Microsoft Defender flagged two trojans on a colleague’s laptop. Both were inside one Chrome extension — an AI sidebar offering ChatGPT, Claude and DeepSeek beside whatever page you’re reading.
Trojan:JS/ChatGPTStealer.GVA!MTB
Trojan:Win32/Qwexlafiba!rfn
extension ID fnmihdojmnkclgjpcoonokmkhjpjechgShe installed it in June 2024 from the official Chrome Web Store. It had a Featured badge and four stars from thousands of reviews.
It is still there. 400,000 users. Updated three days after Defender flagged it. The listing still says the developer will not collect or use your data. (I’m linking the listing so you can verify that claim, not so you can install it. If that link is dead by the time you read this, good.)
Nobody blinked at the permissions, and they were right not to
host_permissions: <all_urls> read and change every page you visit
content_scripts: <all_urls>
permissions: storage, scriptingThat’s alarming written down and completely unremarkable in context — an AI sidebar genuinely needs it. It can’t summarise the page without reading the page. For this category, the permission that enables total compromise is indistinguishable from the permission that enables the feature. There is no anomaly to spot and no prompt a careful user should refuse.
Google has known since January
LayerX, OX Security, Malwarebytes and Microsoft have all published on this family — sixteen or more extensions sharing a codebase, impersonating real AI assistants, harvesting session tokens. Microsoft’s own threat entry for the detection has been public since January.
Above links document these extensions taking AI conversations, tab URLs and ChatGPT account tokens. They do not document them reaching unrelated sites. But that’s what happened with one of our sites. They lifted our hosting credentials, logged-in, created a SFTP user, then installed files and finally injected JS into our website which started showing a fake pop-up to our visitors about a ‘Chrome Update‘, unsuspecting visitors if not careful, would be installing a malware being distributed using our site as distribution channel. When we found it out, we did fix it but it was a really scary experience.
There were probably multiple bad actors involved in all this and someone was responsible for lifting our session token, someone else used it to probably create SFTP users on our hosting panel and maybe someone else wanted to distribute the malware using our website. This was a chain of events and actions. In these extensions, permissions aren’t scoped to AI sites, and nothing in the browser makes them so. <all_urls> with content scripts on every page means read access to your webmail, your hosting panel, your bank — the same access, the same session, no additional prompt.
I reported it. The Chrome Web Store’s report form offers six radio buttons and no field for a detection name, a hash or a C2 domain. It’s product feedback, not abuse reporting.
And the shipping version isn’t detected. On one machine, Defender blocked reads on the older Edge copy while the newer Chrome copy hashed cleanly:
SHA256 — v2.0.6, undetected at time of writing
blueBackground.js CF4991C1AD1F96244E082091052FC8748C64DCD6ECC4D6E32909F3E33A6C51E7
setup.html 7B9608084F09550E75E11713AC17CF2EE8FC5B7376160EFA618C089DC55B9BE9
Infrastructure referenced in the extension code
a.gapier.com both versions
chatgptextension.ai both versions
costgoat.com v2.0.6
agent-marketplace-ot2s.onrender.com v2.0.6
chatgptsidebar.pro v1.9.6Probably not negligence: the malicious behavior is server-controlled, so a reviewer installing it sees a working sidebar behaving perfectly. But the consequence stands — a Featured badge (gone now) and 400,000 users tell you nothing.
Five ordinary decisions
An extension like this doesn’t cause a breach by itself. It combines with things nobody considers a problem.
- An extension reads every page. Necessary for AI assistants. Granted once, at install.
- Web apps hand tokens to the browser. Run
Object.keys(sessionStorage)on your control panel. On a lot of platforms there’s an access token in there. There is noHttpOnlyfor web storage — every script in that origin can read it. This is common enough that the IETF published RFC 10017 this year recommending tokens never reach the browser at all. - Authenticated consoles load third-party scripts. Analytics, chat, session recorders, ad pixels. I counted a dozen suppliers inside one hosting panel, each with the same access as any extension.
- Passwords get shared in chat tools. And stay there permanently.
- One-time codes get forwarded to the team. So the password and its second factor arrive in the same inbox.
Chaining used to be the expensive part
An extension like this doesn’t cause a breach by itself. It combines with things nobody considers a problem — and combining things is exactly what’s getting cheaper using AI Agents.
This isn’t speculative. Anthropic has disclosed a China-nexus actor that used its own agentic coding tool to run espionage operations against roughly thirty organisations, with 80–90% of the tactical work executed without a human in the loop — reconnaissance, vulnerability discovery, credential testing, exfiltration. It’s catalogued by MITRE ATT&CK as Campaign C0062. Palo Alto’s Unit 42 has separately demonstrated a multi-agent system chaining a four-stage attack from a single prompt, with no human intervention between pivots. The Cloud Security Alliance’s assessment is that automated exploit generation has crossed a threshold.
What you can do?
Well I don’t have a clear answer to be ready for these AI assisted breaches and all the bad actors using them to full extent, however below is what could help you against rogue extensions like the one mentioned here:
- See what your extensions can already read. In your admin console’s developer tools:
- document.cookie
- Object.keys(localStorage)
- Object.keys(sessionStorage)
Anything returned is readable by every extension you have installed. If a session token is in that list, any extension can be you — no password, no second factor, no login event.
- Set site access to “on click.”
chrome://extensions→ Details → Site access. Built in, free, almost nobody uses it. An AI sidebar works fine this way; it just can’t sit on your admin panel. - Audit by ID, not name. Names change — this one shipped under two. IDs don’t.
- If you run a team, set an allowlist. Chrome Browser Cloud Management is free with Google Workspace. An afternoon’s work.
- And stop sharing passwords in chat, and stop forwarding one-time codes. If both land in the same inbox, you have one factor with extra steps.
Extension indicators published so others can check their own estates. Platform findings reported to the vendors concerned and withheld pending response.
