“Security Alert: Chrome Extension Compromises Chats of 900,000 Users by Harvesting ChatGPT and DeepSeek Conversations”

Two malicious Chrome extensions have jeopardized more than 900,000 users by covertly extracting ChatGPT and DeepSeek conversations, along with comprehensive browsing histories, to the attackers’ servers.

Uncovered by OX Security analysts, the malware masquerades as the authentic AITOPIA AI sidebar utility, with one counterfeit even acquiring Google’s “Featured” designation.

The OX Research team recognized the peril during standard evaluations, exposing extensions that replicate AITOPIA’s design for conversing with LLMs like GPT and Claude.

Named “Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI” (600K+ users, ID: fnmihdojmnkclgjpcoonokmkhjpjechg, version 1.9.6) and “AI Sidebar with Deepseek, ChatGPT, Claude and more” (300K+ users, ID: inhcgfpbfdjbjogdfjbclgolkmhnooop), these extensions request “anonymous analytics” authorization to disguise data theft.

Threat actors maintain privacy policies on Lovable.dev to obscure sources, while uninstalled extensions redirect to alternate ones.

How the Malware Functions

Installed extensions observe tabs using the chrome.tabs.onUpdated API, creating a unique “gptChatId” for each victim. Upon detecting chatgpt.com or deepseek.com URLs, they scrape DOM elements for prompts, replies, and session IDs, localizing data before Base64-encoding it and dispatching batches to C2 servers such as deepaichats.com or chatsaigpt.com every 30 minutes.

This captures proprietary code, business tactics, PII, search queries, and internal URLs overlooked by AITOPIA’s revealed server storage.

Exposed conversations could jeopardize intellectual property, corporate secrets, and personal information for surveillance or trading on dark web platforms. Browsing histories expose habits, tokens, and organization structures, facilitating phishing or identity theft within affected organizations.

Users ought to visit chrome://extensions, remove by ID, or access store pages: ChatGPT extension, AI Sidebar. Steer clear of unverified extensions despite badges; rely on trustworthy sources.