Malicious Chrome AI Extensions Attacking 260,000 Users via Injected IFrames

Security researchers uncovered a coordinated campaign of malicious Chrome extensions (impersonating ChatGPT, Gemini, Grok, etc.) that have been installed by over 260,000 users. The extensions load attacker-controlled full-screen iframes (e.g., subdomains of tapnetic.pro/onlineapp.pro) to remotely change behavior, capture tab content and voice input, track installs/uninstalls, and a cluster of Gmail-focused extensions scrape email content and exfiltrate it to attacker servers. Operators replace removed extensions by uploading clones with new IDs, use themed subdomains that point to the same backend, and rely on multiple Gmail accounts to manage/publish extensions; defenders are advised to audit AI-branded extensions, monitor for iframe injections and Gmail DOM access, and watch outbound traffic to the identified domains.