Fake AI Assistants in Google Chrome Web Store Steal Passwords and Spy on Emails

Researchers identified a coordinated campaign (AiFrame) of fake AI-assistant Chrome extensions — collectively downloaded by over 260,000 users and including a 50,000+ download 'AI Assistant'— that use shared code, permissions and backend infrastructure to steal credentials, monitor Gmail, and enable remote access. The campaign uses extension-spraying to evade takedowns and full-screen iframes pointing to remote domains to execute malicious functionality outside the Chrome Web Store.