Malicious Chrome Extension Leaks ChatGPT and DeepSeek Chats of 900,000 Users
ID: 25544a95-f9d0-5b5d-bd39-27f0243c5cc9
STIX ID: report--25544a95-f9d0-5b5d-bd39-27f0243c5cc9
Feed Name: GBHackers
Threat Score
Two malicious Chrome extensions impersonating AITOPIA (installed by ~900,000 users) exfiltrate ChatGPT and DeepSeek conversation content, full tab URLs and possible session tokens to the domain deepaichats.com every 30 minutes; the report provides behavioral details, persistence/obfuscation techniques, guidance to remove the extensions, and IoCs (extension IDs, versions, hashes).
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.