Microsoft: Fake AI Extensions Breached Chat Histories in 20,000+ Enterprise Tenants

Microsoft has issued an alert after uncovering a wave of malicious Chromium-based browser extensions masquerading as legitimate AI assistant tools.

The extensions, available on the Chrome Web Store and compatible with both Google Chrome and Microsoft Edge, secretly collected private browser data and AI chat content.

Microsoft found that stolen data included full URLs, internal site details, and snippets of conversations with large language models like ChatGPT and DeepSeek.

Since many professionals use these AI chat tools for coding, business strategy, and confidential writing, the compromised data potentially contains sensitive intellectual property, internal workflows, and trade secrets.

According to Microsoft Defender’s investigation, these fake extensions promoted as ChatGPT or DeepSeek productivity helpers have been installed nearly 900,000 times and are actively affecting more than 20,000 enterprise tenants worldwide.

Microsoft warns that this large-scale data-harvesting operation effectively turned an everyday productivity extension into a persistent surveillance mechanism within enterprise browsers.

Attack chain overview

Reconnaissance: The threat actors exploited the growing popularity of AI chat extensions, imitating trusted brands like “AITOPIA” to appear legitimate.

Some agentic browsers reportedly auto-downloaded these plugins, exploiting user habits and permissive enterprise extension policies.

Weaponization and delivery: The malicious extensions were developed to observe user activity passively.

They logged browsing history and chat content before transmitting data to remote servers. Distributed via the Chrome Web Store, these extensions used attractive names and visuals to bypass user scrutiny and corporate safeguards.

Exploitation and persistence: Once installed, the extensions activated extensive data permissions without further prompts.

Even when users tried to disable tracking, later updates quietly re-enabled telemetry, ensuring continuous monitoring. The extensions remained active across browsing sessions and device restarts, blending in as normal installed extensions.

Command and control: Telemetry and chat data were periodically sent via HTTPS POST requests to attacker-controlled domains such as deepaichats[.]com and chatsaigpt[.]com, camouflaging exfiltration among ordinary web traffic.

Microsoft’s analysis revealed background scripts that logged nearly all visited URLs and AI chat fragments, stored locally in Base64-encoded JSON, and uploaded regularly.

Minimal consent controls and default reactivation of telemetry made the extensions extremely invasive.

These behaviors present a severe compliance and privacy risk, especially in enterprises where browser-based AI use intersects with sensitive data handling.

Mitigations

Overall, the extension functions as a broad telemetry collection mechanism that introduces privacy and compliance risks in enterprise environments.

Microsoft recommends enterprise security teams to:

• Monitor outbound network traffic to known malicious domains (*.chatsaigpt.com, *.deepaichats.com, *.chatgptsidebar.pro).
• Audit and restrict browser extensions via Microsoft Defender Vulnerability Management.
• Enable Defender SmartScreen and Network Protection to block malicious web content.
• Use Microsoft Purview to apply data governance controls on AI-generated content.
• Enforce organizational policies defining approved AI tools and browser extensions.

Employees are also urged to immediately review and remove unfamiliar extensions from their browsers.

Security teams can leverage Microsoft Security Copilot for deeper threat hunting and intelligence context.

Microsoft Defender XDR includes detections for this activity and can assist organizations in identifying affected endpoints, investigating incidents, and responding to potential data exfiltration.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.