How We Discovered A Campaign of 16 Malicious Extensions Built to Steal ChatGPT Accounts

Akamai acquired LayerX. This previously published blog post reflects the product and feature names on the original date of publication.

LayerX Research identified a coordinated set of Chrome browser extensions marketed as ChatGPT enhancement and productivity tools. In practice, however, these extensions are meant to steal users’ ChatGPT identities. The campaign consists of at least 16 distinct extensions developed by the same threat actor, in order to reach as wide a distribution as possible.

This campaign coincides with a broader trend: the rapid growth in adoption of AI-powered browser extensions, aimed at helping users with their everyday productivity needs. While most of them are completely benign, many of these extensions mimic known brands to gain users’ trust, particularly those designed to enhance interaction with large language models. As these extensions increasingly require deep integration with authenticated web applications, they introduce a materially expanded browser attack surface.

Our analysis shows that extensions in this campaign implement a common mechanism that intercepts ChatGPT session authentication tokens and transmits them to a third-party backend. Possession of such tokens provides account-level access equivalent to that of the user, including access to conversation history and metadata. As a result, attackers can replicate the users’ access credentials to ChatGPT and impersonate them, allowing them to access all of the user’s ChatGPT conversations, data, or code. 

This discovery underscores the need for corporations to monitor and restrict the use of 3rd-party AI extensions, as they may be stealing sensitive information. 

While these extensions do not exploit vulnerabilities in ChatGPT itself, their design enables session hijacking and covert account access, representing a significant security and privacy risk.

Currently, approximately 900 downloads are associated with this campaign — a drop in the bucket compared to GhostPoster or RolyPoly VPN. However, while the scope of an attack is an obvious indicator of its relevance, it’s not the only one. GPT Optimizers are popular and there are enough highy-rated, legitmate ones on the Chrome Web Store that people could easily miss any warning signs, and one of the variants has a “featured” logo that states it “following recommended practies for Chrome extensions.”

It just takes one iteration for a malicious extenstion to become popular. We believe that GPT optmizers will soon become as popular as (not more than) VPN extnesions, which is why we prioritized the publication of this analysis. Our goal is to shut it down BEFORE it hits critical mass.

The primary security issue identified across the campaign is ChatGPT session token interception. 

Across all analyzed variants (with one exception), the extensions implement the following workflow:

1. A content script is injected into chatgpt.com and executed in the page’s MAIN JavaScript world.
2. The script hooks the browser’s window.fetch function, allowing it to observe outbound requests initiated by the ChatGPT web application.

  3. When a request containing an authorization header is detected, the session token is extracted.

  4. A second content script receives this message and transmits the token to a remote server.

This approach allows the extension operator to authenticate to ChatGPT services using the victim’s active session and obtain all users’ history chats and connectors (the users’ Google drive, Slack, Git-hub and other sensitive data sources).

Extension’s interception content script executed in the MAIN world:

Executing content scripts in the MAIN JavaScript world enables direct interaction with the page’s native runtime, rather than operating within Chrome’s isolated content-script environment.

Specifically, this means the extension code:

• Runs in the same execution context as the web application itself
• Has access to the same JavaScript objects, functions, and in-memory state used by the page
• Can override or wrap native APIs (e.g., window.fetch, XMLHttpRequest, Promise, application-defined functions)
• Can observe or manipulate runtime data that never traverses the network or DOM, including:
  • authentication headers before transmission
  • in-memory tokens and session artifacts
  • application state objects used by the frontend framework

In addition to the ChatGPT session token, the following data is sent to the third-party server:

• Extension metadata (version, locale, client identifiers)
• Usage telemetry and event data
• Backend-issued access tokens used by the extension service

this data allows the attacker to further expand access tokens and enables persistent user identification, behavioral profiling, and long-lived access to third-party services. When combined, these data elements can be used to correlate activity across sessions, infer usage patterns, and maintain ongoing access beyond a single browser interaction, increasing both the privacy impact and the potential blast radius of any misuse or compromise of the supporting infrastructure.

• Batch uploads, with multiple extensions published on the same dates
• Synchronized update timelines, with several extensions updated concurrently
• Shared backend infrastructure, with all extensions communicating with the same domain
• Overlapping legitimate functionality, reinforcing perceived trustworthiness

Early Detection via Extension Intelligence

LayerX Research was able to identify and attribute this campaign at an early stage through a combination of AI-driven browser extension detection and code similarity analysis.

Specifically, our detection capabilities enabled:

• Identification of shared, minified code artifacts across multiple extension IDs

• Correlation of extensions with near-identical runtime behavior, despite differing names and feature descriptions
• Recognition of variant proliferation patterns, where multiple extensions with overlapping functionality are published and updated in coordinated batches

These signals allowed us to cluster the extensions into a single campaign before widespread adoption, highlighting the importance of proactive visibility into browser extension ecosystems as AI tooling continues to expand.

chatgptmods.com

Imagents.top

support@imagents.top