January 30, 2026 – A massive campaign of malicious browser extensions is currently targeting nearly a million users to steal sensitive AI conversations and commit affiliate fraud. New threat intelligence links widespread “prompt poaching” and revenue hijacking to a sophisticated threat actor known as DarkSpectre.
Scope of the Attack
The malicious activity centers on two primary vectors: the exfiltration of private chats from AI platforms like ChatGPT and DeepSeek, and the stealthy hijacking of e-commerce affiliate links.
Two extensions posing as productivity tools – “Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI” and “AI Sidebar with Deepseek, ChatGPT, Claude and more” – have compromised over 900,000 users. These extensions mimic legitimate software to capture every interaction users have with AI chatbots. The malware transmits sensitive corporate data and personal queries to attacker-controlled servers every 30 minutes.
Simultaneously, the “Amazon Ads Blocker” extension presents a separate threat. While masquerading as a privacy tool, this extension systematically replaces legitimate affiliate tags on Amazon product links with its own (“10xprofit-20”). This process diverts revenue from content creators to the malware operators without the user’s knowledge.
The “Prompt Poaching” Threat
The theft of AI interaction data, now identified as “prompt poaching,” represents a critical escalation in browser-based threats. Unlike traditional credential theft, this technique captures unstructured data that often contains intellectual property, source code, and internal business strategies pasted into AI tools by employees.
Compromised extensions facilitate this by requesting broad permissions to “read and change all your data on all websites.” Users often grant these privileges without scrutiny, allowing extensions to scrape content from any visited page, including secure AI chat sessions.
Connection to DarkSpectre
Intelligence indicates these incidents are part of a broader operation by “DarkSpectre,” a threat group responsible for infecting over 8.8 million browsers across Chrome, Edge, and Firefox over the last seven years. The group is known for its “long game” strategy—publishing functional, benign-appearing extensions to build a user base before updating them with malicious payloads.
Key indicators of the DarkSpectre campaign include:
- Legitimate facades: Extensions often work as advertised (e.g., blocking ads or summarizing text) to avoid suspicion.
- Delayed execution: Malicious code often activates days or weeks after installation.
- Obfuscation: Use of steganography (hiding code in images) and heavy encryption to bypass automated store scanners.
Immediate Action Required
Security professionals and IT administrators are urged to audit their environments immediately.
- Identify and Remove: Scan for and uninstall “Amazon Ads Blocker,” “Chat GPT for Chrome,” and “AI Sidebar.”
- Review Permissions: Block extensions that request access to all website data unless strictly necessary.
- Restrict Installation: Enforce enterprise policies that only allow extensions from a strictly allow-listed set.
Google has removed several of the offending extensions from the Chrome Web Store following disclosure, but installed versions may remain active on devices until manually removed.
Sources:
- https://www.security.com/threat-intelligence/chrome-extensions-are-you-getting-more-you-bargained
- https://www.paubox.com/blog/malicious-browser-extensions-tied-to-darkspectre-affect-millions-worldwide
- https://thehackernews.com/2026/01/researchers-uncover-chrome-extensions.html
- https://www.pcworld.com/article/3037666/840000-users-hit-by-malicious-browser-extensions-uninstall-these-asap.html
- https://socket.dev/blog/malicious-chrome-extension-performs-hidden-affiliate-hijacking
