900,000 Users Hit as Malicious Chrome Extensions Steal ChatGPT, DeepSeek Chats

**Executive summary:** OX Security reported that malicious Chrome extensions masquerading as productivity tools exposed sensitive ChatGPT and DeepSeek conversations from over 900,000 users by abusing extension permissions and browser APIs to scrape DOM content, tag sessions with unique identifiers, aggregate and Base64-encode data, and periodically exfiltrate it to attacker-controlled C2 servers; the article describes the technical TTPs and recommends removal, allowlisting, DLP, monitoring, and user training.