AI Impersonators: Malicious Chrome Extensions Steal User Credentials and Data

In an increasingly digital world, the convenience offered by AI-powered browser extensions has become undeniable. Yet, this very convenience is being weaponized by sophisticated threat actors. A recent investigation by security firm LayerX has unveiled a pervasive new campaign, dubbed “AiFrame,” where malicious Chrome add-ons masquerade as popular AI assistants, compromising user security on a massive scale.

The AiFrame Deception: A Widespread Threat

Building on previous schemes like the multi-browser GhostPoster campaign, AiFrame represents a significant escalation. Researchers have identified approximately 30 Chrome extensions that cunningly impersonate well-known AI tools such as Claude, ChatGPT, Gemini, Grok, and even a deceptive “AI Gmail” assistant. These fraudulent extensions have collectively amassed over 300,000 installations, lulling users into a false sense of security with their familiar branding and seemingly legitimate functionalities.

How the Malicious Extensions Operate

Upon installation, these seemingly innocuous AI assistants transform into powerful surveillance tools. Far from offering local AI capabilities, they establish wide-ranging remote access to the user’s browser. LayerX’s analysis reveals a disturbing array of capabilities, including voice recognition, pixel tracking, and the ability to read email content. Essentially, these extensions are designed to harvest sensitive data and meticulously monitor user behavior.

A key to their stealth lies in their architecture. Despite varying names and branding, all 30 identified extensions share an identical internal structure, logic, permissions, and backend infrastructure. Instead of processing data on the user’s device, they render a full-screen iframe that loads remote content as the extension’s interface. This ingenious method allows attackers to push silent updates and changes at any time, bypassing the need for Chrome Web Store approval and making detection and removal a continuous challenge.

Protecting Yourself: Identifying and Removing the Threat

Given the sophisticated nature of these attacks, user vigilance is paramount. LayerX has provided a comprehensive list of the malicious extension names and their corresponding IDs, which users are strongly advised to consult. The generic or familiar branding employed by threat actors, such as “Gemini AI Sidebar” or “ChatGPT Translate,” makes initial identification difficult.

Steps to Take If You Suspect Infection:

• Navigate to chrome://extensions in your Chrome browser.
• Toggle on “Developer mode” in the top-right corner.
• Carefully examine your installed extensions. Look for the ID displayed below each extension name.
• Cross-reference these IDs with any known malicious lists (e.g., from LayerX’s reports).
• Immediately remove any suspicious or confirmed malicious add-ons.

• Reset all critical passwords, especially for email, banking, and other sensitive accounts, as your credentials may have been compromised.

The Persistent Challenge of Cybercrime

While reports from BleepingComputer indicate that some of these malicious extensions have been removed from the Chrome Web Store, others regrettably remain active. Worryingly, several even bore the “Featured” badge, lending them an undeserved air of legitimacy. Threat actors have also demonstrated a troubling ability to quickly republish these add-ons under new names, leveraging their existing infrastructure. This means the AiFrame campaign, and others like it, are likely to persist and evolve.

The takeaway is clear: always vet browser extensions meticulously. Do not rely solely on a familiar name or a “Featured” badge. Furthermore, be aware that even AI-powered add-ons from trusted sources can be highly invasive, collecting significant amounts of personal data. Prioritize your digital security by understanding what you install and the permissions you grant.

For more details, visit our website.

Source: Link