Fake ChatGPT and DeepSeek Extensions Spied on Over 1 Million Chrome Users

Researchers discovered two malicious Chrome extensions masquerading as legitimate AI sidebar tools that used DOM scraping to capture user prompts, AI responses, and session/authentication tokens from ChatGPT and DeepSeek, exfiltrating the data to external domains; together the extensions had about 900,000 installs and remained available after disclosure, with published IOCs and removal guidance.