Two browser extensions, “Smart Adblocker” and “Adblock for Browser,” have been discovered covertly recording private conversations from AI platforms such as ChatGPT, Claude, Gemini, and others. These extensions, installed by approximately 90,000 users, provided legitimate ad-blocking functionality while secretly capturing users’ AI interactions.
Identified as “PromptSnatcher” by researchers, this operation involved the extensions recording entire conversation histories, identifying the AI models in use, and determining users’ subscription statuses. The sophistication of this data collection indicates a well-organized effort with potential commercial motives.
Analysts at MalExt Sentry uncovered the scheme when an automated scanner detected a recurring Google Tag Manager ID across multiple extensions. This led to the realization that the two extensions, despite different names and domains, shared identical backend code and infrastructure, effectively functioning as the same tool developed by a single operator. This tactic of deploying under different names is a known strategy to increase reach and reduce the risk of a complete takedown.
The extensions utilized genuine ad-blocking filter lists like EasyList, providing real functionality that could pass casual inspection. The malicious data collection component was separate from the ad-blocking features, making detection challenging without in-depth code analysis.
Mechanism of Data Collection
The core of the attack involved a script named shared-page-capture.js, which was injected into active web pages. This script intercepted all network traffic by modifying global functions such as fetch, XMLHttpRequest, and WebSocket. Consequently, every message sent to or received from an AI chatbot was processed by the malicious code before reaching the user.
Captured conversations were buffered, with prompts stored up to 10,000 characters and responses up to 30,000 characters, before being transmitted to servers controlled by the operators. Each transmission included a unique device ID, platform name, conversation ID, AI model, user subscription tier, and timestamp. This detailed data collection suggests intentions for resale or the creation of comprehensive profiles of AI users.
The attack targeted eight platforms: ChatGPT, Gemini, Claude, Copilot, Perplexity, DeepSeek, Grok, and Meta AI. The operators could add new targets remotely through a configuration server without requiring extension updates. Notably, Meta AI was not listed in the static extension code but was included in the dynamic configuration, indicating the operators’ ability to adapt their targets swiftly.
Implications and Recommendations
This incident underscores the growing trend of cybercriminals exploiting the popularity of AI tools by distributing malicious browser extensions. Users are advised to exercise caution when installing extensions, even those that appear legitimate. Regularly reviewing and auditing installed extensions, especially those requesting extensive permissions, is crucial. Additionally, organizations should implement security measures to monitor and control the use of browser extensions within their networks to prevent potential data breaches.
As AI platforms become increasingly integrated into daily workflows, the security of these tools and their associated extensions must be a priority. Vigilance and proactive security practices are essential to safeguard sensitive information from such sophisticated threats.
