16 Malicious Chrome Extensions Exploit ChatGPT Logins to Steal User Credentials

A coordinated campaign involving at least 16 malicious Chrome browser extensions disguised as ChatGPT productivity tools that actively steal user authentication credentials.

The extensions, developed by a single threat actor, target ChatGPT session tokens to gain unauthorized access to accounts, compromising conversation history, metadata, and connected data sources.

The malicious campaign exploits the surging popularity of AI-powered browser extensions designed to enhance ChatGPT functionality.

While most AI extensions serve legitimate purposes, these malicious variants mimic trusted brands to deceive users into installation.

The extensions require deep integration with authenticated web applications, significantly expanding the browser attack surface and creating opportunities for credential theft.

The threat actor’s strategy focuses on maximizing distribution through multiple extension variants, each marketed with slightly different branding and features.

This approach increases the likelihood that users will encounter and install at least one malicious extension while searching for ChatGPT enhancement tools.

The core attack mechanism implemented across all campaign variants involves intercepting ChatGPT session authentication tokens and transmitting them to an attacker-controlled infrastructure.

The extensions inject content scripts into chatgpt.com that execute in the browser’s MAIN JavaScript world, allowing direct interaction with the page’s native runtime environment.

LayerX Research identified malicious code hooks the browser’s window.fetch function to observe outbound requests from the ChatGPT web application.

When requests containing authorization headers are detected, the session tokens are extracted and exfiltrated to remote servers.

This technique enables attackers to replicate user credentials and impersonate victims, gaining full access to ChatGPT conversations, code, and connected third-party services including Google Drive, Slack, and GitHub.

Technical Implementation Details

Attack Component	Technical Method	Impact
Script Injection	Content script in MAIN JavaScript world	Direct access to page runtime and in-memory data
Token Capture	window.fetch API hooking	Intercepts authorization headers before transmission
Data Exfiltration	Secondary content script transmission	Sends tokens to attacker-controlled backend
Persistent Access	Backend-issued access tokens	Maintains long-term account access beyond single session

Executing content scripts in the MAIN world rather than Chrome’s isolated content-script environment allows the malicious code to override native APIs and access authentication artifacts that never traverse the network or DOM.

This approach effectively bypasses conventional security controls that monitor network traffic or DOM manipulation.

Beyond session tokens, the extensions exfiltrate extension metadata, usage telemetry, client identifiers, and backend-issued access tokens.

This additional data enables behavioral profiling, persistent user identification, and correlation of activity across multiple sessions, substantially increasing the privacy impact and potential damage from account compromise.

Campaign Distribution and Scope

Of the 16 identified extensions, 15 were distributed through the Chrome Web Store, while one appeared on the Microsoft Edge Add-ons marketplace.

All extensions remained available in their respective stores at the time of publication, with approximately 900 total downloads recorded.

While this represents modest adoption compared to larger campaigns like GhostPoster or RolyPoly VPN, the threat remains significant due to the popularity of legitimate ChatGPT optimization tools.

All extensions share a minified codebase reused across multiple extension IDs, with consistent publisher characteristics despite using different listings. Visual branding shows striking similarities, including near-identical icons and descriptions.

Temporal analysis reveals batch upload patterns, with multiple extensions published on identical dates and synchronized update timelines.

LayerX’s AI-driven extension detection and code similarity analysis enabled early identification of shared code artifacts and variant proliferation patterns before widespread adoption occurred, highlighting the critical importance of proactive browser extension ecosystem monitoring.

This campaign demonstrates how browser extensions targeting AI platforms can achieve account-level access through legitimate session mechanisms without exploiting software vulnerabilities or deploying traditional malware.

The combination of MAIN-world execution and authentication token interception allows attackers to obtain persistent access while remaining within standard web behavior boundaries, making detection using traditional endpoint or network security tools particularly challenging.

Organizations must recognize that third-party AI extensions represent high-risk software requiring rigorous scrutiny.

As AI platforms become increasingly integrated into enterprise workflows, corporations need comprehensive visibility into browser extension usage and enforcement mechanisms to restrict unapproved extensions that may exfiltrate sensitive information.

Indicators of Compromise (IOCs)

ID	Extension Name	Installs
lmiigijnefpkjcenfbinhdpafehaddag	ChatGPT folder, voice download, prompt manager, free tools – ChatGPT Mods	605
obdobankihdfckkbfnoglefmdgmblcld	ChatGPT voice download, TTS download – ChatGPT Mods	156
kefnabicobeigajdngijnnjmljehknjl	ChatGPT pin chat, bookmark – ChatGPT Mods	18
ifjimhnbnbniiiaihphlclkpfikcdkab	ChatGPT message navigator, history scroller – ChatGPT Mods	11
pfgbcfaiglkcoclichlojeaklcfboieh	ChatGPT model switch, save advanced model uses – ChatGPT Mods	11
hljdedgemmmkdalbnmnpoimdedckdkhm	ChatGPT export, Markdown, JSON, images – ChatGPT Mods	10
afjenpabhpfodjpncbiiahbknnghabdc	ChatGPT Timestamp Display – ChatGPT Mods	13
gbcgjnbccjojicobfimcnfjddhpphaod	ChatGPT bulk delete, Chat manager – ChatGPT Mods	11
ipjgfhcjeckaibnohigmbcaonfcjepmb	ChatGPT search history, locate specific messages – ChatGPT Mods	11
mmjmcfaejolfbenlplfoihnobnggljij	ChatGPT prompt optimization – ChatGPT Mods	10
lechagcebaneoafonkbfkljmbmaaoaec	Collapsed message – ChatGPT Mods	13
nhnfaiiobkpbenbbiblmgncgokeknnno	Multi-Profile Management & Switching – ChatGPT Mods	0
hpcejjllhbalkcmdikecfngkepppoknd	Search with ChatGPT – ChatGPT Mods	0
hfdpdgblphooommgcjdnnmhpglleaafj	ChatGPT Token counter – ChatGPT Mods	5
ioaeacncbhpmlkediaagefiegegknglc	ChatGPT Prompt Manager, Folder, Library, Auto Send – ChatGPT Mods	5
jhohjhmbiakpgedidneeloaoloadlbdj	ChatGPT Mods – Folder Voice Download & More Free Tools	17

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.