AI Sidebar Spoofing Attack: SquareX Uncovers Malicious Extensions that Impersonate AI Browser Sidebars

SquareX published research demonstrating an "AI Sidebar Spoofing" attack in which malicious browser extensions render pixel-perfect replicas of AI sidebars to return fraudulent AI-generated instructions. By exploiting user trust in AI sidebars across AI-enabled and consumer browsers, attackers can phish credentials, trick users into executing malicious commands, exfiltrate passwords, and enable remote device hijacking or ransomware; the technique requires only common extension permissions and can remain dormant until triggered.