PromptSnatcher (internal identifier: Panel 231) is a modern, stealthy data collection operation embedded inside two browser extensions that masquerade as ad‑blockers while harvesting full chat conversations and account metadata from major AI platforms.
The extensions deliver genuine ad‑blocking and cookie‑banner suppression by ingesting legitimate public filter lists such as EasyList and I Don’t Care About Cookies, but they also ship a bespoke interception engine that captures non‑public conversation text, model identifiers, and subscription‑tier signals from ChatGPT, Gemini, Claude, Copilot, Perplexity, Grok, DeepSeek and Meta AI.
The campaign demonstrates clear, modular design, remote configurability, and deliberate attempts to conceal telemetry inside legitimate functionality.
The discovery began when the MalExt Sentry automated scanner flagged a recurring Google Tag Manager ID (GTM‑TCT2RJ) across multiple extensions’ filter rules.
That GTM artifact traced back to a rule in the IDCAC list and proved non‑attributive, but it provided a forensic pivot for manual review.
Deeper static and dynamic analysis revealed the true linkage: a shared “Panel 231” SDK present in both extensions.
The SDK contains identical obfuscated exfiltration logic, a common LDP_MESSAGE internal messaging protocol, and matching command‑and‑control (C2) behavior patterns across distinct publisher domains.
The investigation was initially flagged by the MalExt Sentry automated scanner due to a recurrence of the Google Tag Manager ID GTM-TCT2RJ across multiple extensions’ filter rules.
Forensics show an original, professional background manager rather than borrowed privacy‑extension code.
PromptSnatcher Browser Extensions Abuse AI
The engine implements a user onboarding “Enhanced Protection” flow that does not specify AI conversation capture and fetches platform‑specific parsing logic at runtime from a /configuration endpoint.
This dynamic payload approach allows the operator to add or modify parsing rules and activate new targets without pushing extension updates to the browser stores.
In practice, the extension injects a capture script into the page main world that patches global fetch, XMLHttpRequest, and WebSocket constructors to clone outgoing and incoming traffic in real time.
Captured content is buffered and relayed through the LDP_MESSAGE channel to the background worker, then POSTed to a /captures API with a persistent per‑install UUID, platform ID, conversation ID, model name, subscription tier and timestamp.
The remote configuration (Config v1.0.1) exposes the campaign’s scope and sophistication. Targets include ChatGPT (fetch scraping window._STATSIG_ to obtain is_paid), Gemini (XHR parsing for a wrb‑frames protocol), Claude (probing /api/organizations for capabilities), Copilot (intercepting SignalR frames over WebSocket and probing Pro tier), Perplexity (scraping subscription_status), Grok and DeepSeek via backend APIs, and Meta AI via GraphQL variables.
Notably Meta AI is absent from static manifests but present in the live remote config, underlining the operator’s ability to enable new platforms on demand.
The capture payloads are sizable (buffers configured for tens of thousands of characters) to ensure full prompts and responses are retained.
Infrastructure is segmented: Extension A calls c.smartadblocker.com while Extension B calls c.abforbrowser.com. The /configuration endpoint returns a Base64‑encoded parser ruleset and validates requests via an Origin header tied to the extension ID, limiting casual probing.
Despite this operational discipline, a material disclosure discrepancy exists: the Firefox variants declare data_collection_permissions: none in their manifests, yet they exhibit the same capture behavior as the Chrome builds.
PromptSnatcher is deployed to roughly 90,000 users, making it one of the more consequential client‑side data exfiltration campaigns targeting AI conversations.
Defenders should prioritize removing the affected extensions, block the listed C2 domains at network perimeter, and audit any sensitive prompts or responses potentially exposed.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
 is a modern, stealthy data collection operation embedded inside two browser extensions that masquerade as ad‑blockers.){kind=link}