Researchers Uncover Chrome Extensions Abusing Affiliate Links and Stealing ChatGPT Access

Security researchers uncovered coordinated networks of malicious Chrome (and Edge) extensions that hijack affiliate links across e-commerce sites, scrape and exfiltrate product data to attacker-controlled endpoints, and intercept ChatGPT authentication tokens by injecting content scripts into chatgpt.com; the clusters include dozens of extensions (many listed by ID), have evidence of active distribution and abuse (some with large user counts), and are complemented by a commercial 'Stanley' malware-as-a-service kit that generates phishing-capable extensions.