logo

Fake ChatGPT Ad Blocker Chrome Extension Caught Spying on Users

ID: f96d1168-03a3-5de6-96cc-9625e3c48fff

STIX ID: report--f96d1168-03a3-5de6-96cc-9625e3c48fff

Feed Name: HackRead

Threat Score
70/100

Date Published: 2026-04-03

Date Updated: 2026-04-22

Author: Deeba Ahmed

...
...

A malicious Chrome extension named "ChatGPT Ad Blocker" was available on the official Chrome Web Store and secretly cloned the ChatGPT page DOM to capture conversations and metadata, sending any text over 150 characters to a Discord webhook (handled by a bot named Captain Hook). The extension also polled a GitHub file hourly for remote instructions; investigators linked the developer handle to multiple AI platforms and to suspicious domains (blockaiads.com, openadblock.com, gptadblock.com). DomainTools warns users to avoid third-party ad-blocking tools and treat any tools tied to this developer with suspicion.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.