PromptSnatcher Browser Extensions Abuse AI Platforms to Capture Full Chat Conversations

PromptSnatcher is a sophisticated, modular data‑exfiltration campaign embedded in two browser extensions that pose as ad‑blockers while intercepting and exfiltrating full AI platform conversations (ChatGPT, Gemini, Claude, Copilot, Perplexity, Grok, DeepSeek, Meta AI). The extensions use an embedded “Panel 231” SDK with obfuscated exfiltration logic, runtime‑fetched parsing rules allowing dynamic target expansion, and segmented C2 infrastructure (c.smartadblocker.com, c.abforbrowser.com); roughly 90,000 installs are reported and defenders are advised to remove the extensions, block C2 domains, and audit exposed prompts.