Fake AI Chrome extensions with 300K users steal credentials, emails

**AiFrame malicious Chrome-extension campaign:** Security researchers discovered 30 Chrome extensions (over 300,000 installs) posing as AI assistants that render remote iframes and siphon sensitive data — including credentials, Gmail messages (including drafts), browsing context, and voice transcripts — to attacker-controlled servers (tapnetic.pro). The extensions share common code, permissions, and infrastructure; some remain listed in the Chrome Web Store, and LayerX provides indicators of compromise for detection and remediation.