Malicious Chrome Extensions Used for Data Theft via Ownership Transfers and Impersonation
Multiple malicious Chrome/Chromium extensions were identified abusing the Chrome Web Store to steal data from users and enterprises. Two previously legitimate extensions—QuickLens (kdenlnncndfnhkognokgfpabgkgehodd) and ShotBird (gengfhhkjekmlejbhmmopegofnoifnjp)—reportedly turned malicious after ownership transfers, enabling downstream compromise through injected code and data harvesting. In the QuickLens case, researchers reported the malicious update preserved expected functionality while adding capabilities to strip security headers (e.g., X-Frame-Options) and facilitate script injection that can bypass Content Security Policy (CSP) protections, expanding the attacker’s ability to make cross-domain requests and collect sensitive information.
Separately, Microsoft reported a campaign of counterfeit “AI assistant” browser extensions distributed via the Chrome Web Store (and therefore also impacting Microsoft Edge environments that allow Chrome extensions), which allegedly affected 20,000+ enterprise tenants and amassed roughly 900,000 installs. These extensions impersonated legitimate AI productivity tools and harvested ChatGPT/DeepSeek conversation histories, visited URLs, and browsing telemetry, staging data for exfiltration to attacker-controlled infrastructure. Another Chrome Web Store threat involved a fake imToken-branded extension (“lmΤoken Chromophore”) that masqueraded as a benign tool but redirected victims to phishing infrastructure to steal seed phrases and private keys, using tactics like hardcoded remote configuration (via JSONKeeper) and decoy navigation to the legitimate token.im site after credential capture.
Timeline
Mar 9, 2026
Researchers link QuickLens and ShotBird to likely same actor
Analysis found shared command-and-control patterns, ClickFix lures, and the same ownership-transfer infection vector across QuickLens and ShotBird, leading researchers to assess that a single threat actor likely operated both extensions. Users were advised to remove the extensions immediately and tighten extension-installation controls.
Mar 9, 2026
QuickLens and ShotBird turn malicious after ownership transfer
Two Chrome extensions, QuickLens and ShotBird, became malicious following apparent ownership transfers. Their updated code enabled remote JavaScript execution, code injection, downstream malware delivery, and theft of sensitive browser and endpoint data.
Mar 9, 2026
Microsoft warns of large-scale data theft via fake AI extensions
Microsoft publicly warned that fake AI assistant browser extensions distributed through the Chrome Web Store were compromising enterprise users, including some Microsoft Edge users due to Chromium extension compatibility. The company recommended extension audits, allowlisting, and blocking outbound traffic to the identified attacker domains.
Mar 9, 2026
Microsoft detects fake AI browser extension campaign across enterprise tenants
Microsoft Defender analysts identified a campaign of counterfeit AI-themed Chromium extensions after observing unusual outbound connections from installed extensions in enterprise environments. The activity affected more than 20,000 enterprise tenants and involved nearly 900,000 installs, with the extensions harvesting chat histories, visited URLs, and browsing telemetry.
Mar 7, 2026
Socket discloses IOCs and technical details for fake imToken extension
Socket’s Threat Research Team published analysis of the malicious imToken-themed extension, describing its use of Unicode homoglyphs, a JSONKeeper-hosted remote redirect, external JavaScript for wallet-import phishing, and a decoy redirect to the legitimate token.im site. The report also shared indicators of compromise and urged affected users to rotate funds to new keys.
Mar 7, 2026
Malicious imToken-lookalike Chrome extension deployed to steal wallet secrets
A Chrome extension named "lmΤoken Chromophore" impersonated the imToken wallet brand while posing as a hex color visualizer. It redirected users to attacker-controlled phishing pages to capture 12/24-word seed phrases and plaintext private keys, enabling immediate cryptocurrency wallet takeover.
See the full picture in Mallory
Mallory subscribers get deeper analysis on every story, including:
Who’s affected and how
Deep-dive technical analysis
Actionable next steps for your team
IPs, domains, hashes, and more
Ask questions and take action on every story
Filter by topic, classification, timeframe
Get matching stories delivered automatically
Related Entities
Malware
Organizations
Sources
Related Stories
Malicious Chrome Extensions Impersonate AI Assistants and Crypto Wallets to Steal Sensitive Data
Microsoft reported a campaign of **malicious Chromium-based browser extensions** masquerading as legitimate AI assistant tools to **harvest LLM chat histories and browsing data**, with reporting suggesting ~**900,000 installs** and Microsoft Defender telemetry indicating activity across **20,000+ enterprise tenants**. The extensions collected full URLs and chat content from services including **ChatGPT** and **DeepSeek**, creating a high-risk data leakage path for proprietary code, internal workflows, and strategic discussions; Microsoft also noted cases where “agentic” browsers auto-downloaded these extensions, reducing user friction and increasing exposure. Separately, Socket documented a **fake imToken** Chrome extension (`bbhaganppipihlhjgaaeeeefbaoihcgi`) that posed as a benign “hex color visualizer” but functioned as a **phishing redirector**: on install and on click it opened attacker-controlled pages, pulling a destination URL from `jsonkeeper[.]com/b/KUWNE` and sending victims to `chroomewedbstorre-detail-extension[.]com` to solicit **12/24-word seed phrases** or **private keys** for wallet takeover. A Kaspersky post focused on consumer guidance for disabling unwanted AI features and broadly warned about privacy/security risks from pervasive AI assistants (including mention of insecure third-party “personal agent” setups), but it did not provide corroborated details tied to the specific malicious-extension campaigns described by Microsoft and Socket.
2 days ago
Malicious and High-Risk AI-Powered Chrome Extensions Enable Account Hijacking and Phishing
Security researchers reported multiple risks tied to **AI-themed browser extensions** in the Chrome/Edge ecosystem, including active malicious campaigns. Malwarebytes identified **16 malicious extensions** (15 Chrome, 1 Edge) masquerading as ChatGPT “enhancers” that **steal ChatGPT session tokens**, enabling attackers to take over accounts and access conversation history and metadata; the extensions also exfiltrate additional telemetry (e.g., extension version/language and usage details) to help attackers profile victims and maintain longer-term access. Separately, Varonis described a new **malware-as-a-service** offering called **“Stanley”** that claims to reliably get **phishing-capable Chrome extensions** through Chrome Web Store review, using full-screen `iframe` overlays to present attacker-controlled login pages while the address bar continues to show the legitimate domain; it also advertises auto-install support across Chrome/Edge/Brave, a management panel, geo/IP targeting, and frequent C2 polling. In parallel with these overtly malicious cases, an Incogni study of **442 AI-powered Chrome extensions** found broad privacy and security exposure from over-privileged extensions (e.g., script injection and deep page access) and extensive data collection (52% collecting user data), highlighting that even popular tools (e.g., **Grammarly** and **QuillBot**) can present significant privacy risk due to the scope of permissions and data categories collected.
1 months ago
Malicious Chrome Extensions Used for Credential Theft and Website Spoofing
Security researchers reported a surge in **malicious Chrome extensions** abusing high-privilege browser permissions to steal credentials and hijack authenticated sessions. LayerX identified at least **16 ChatGPT-related extensions** that mimic legitimate productivity tools and brands, then inject scripts into `chatgpt.com` to monitor outbound web requests and **exfiltrate authorization details and session tokens** to attacker-controlled infrastructure. With stolen tokens, attackers can impersonate victims’ ChatGPT sessions and potentially access connected data sources (e.g., integrations with *Slack* and *GitHub*), expanding impact beyond the AI service itself. Separately, Varonis documented a **malware-as-a-service** browser-extension toolkit dubbed **Stanley** being sold on Russian-language cybercrime forums, marketed to enable large-scale credential theft by **showing a phishing site while the URL bar continues to display the legitimate domain**. The toolkit uses a web-based control panel to configure per-victim “source” (legitimate) and “target” (phishing) URLs, then overlays a full-screen iframe to spoof the destination site; the seller also claims “guaranteed” placement in the **Chrome Web Store**, increasing the likelihood of user installation and enterprise exposure.
1 months ago