Chrome Extensions Caught Exfiltrating ChatGPT and DeepSeek Conversations from Over 900,000 Users

Executive Summary: Researchers discovered two malicious Chrome extensions marketed as AI productivity tools that collected user prompts, AI-generated responses, open-tab URLs, and browser metadata from platforms like ChatGPT and DeepSeek; with over 900,000 installs, the extensions used DOM parsing, permissions abuse, local storage, and periodic exfiltration to send sensitive data to attacker-controlled servers, creating significant risk of corporate espionage, identity theft, targeted phishing, and sale of confidential information.