16 Fake ChatGPT Extensions Caught Hijacking User Accounts

Researchers at LayerX Security uncovered a coordinated campaign of at least 16 malicious browser extensions masquerading as ChatGPT productivity add-ons that steal session tokens to hijack user accounts; about 900 downloads have been observed, the extensions share code, icons, and attacker-controlled domains (e.g., chatgptmods.com, Imagents.top), run with high browser privileges, and can expose connected services like Slack, GitHub, and Google Drive—users are advised to remove any unrecognized AI-linked extensions.