📰 AI News: Malicious Chrome Extensions Are Stealing Your AI Chats And Crypto
📝 TL;DR Several popular Chrome extensions were hijacked or built as malware, stealing crypto, passwords, and even AI chat histories from over a million users. If you use AI tools or a browser wallet, you need to treat your extensions like a live security risk today, not a someday problem. 🧠 Overview In the last few days, security researchers and wallet providers have revealed a cluster of serious extension based attacks. A malicious Trust Wallet update drained over 7 million dollars from users, while fake AI extensions quietly siphoned private chat histories and login data from hundreds of thousands of people. These attacks did not require you to click a dodgy link, the only step was installing or auto updating a “trusted” extension from the Chrome Web Store. 📜 The Announcement A compromised Trust Wallet browser extension update, version 2.68, was pushed after attackers obtained a leaked API key. Between December 24 to 26, that update harvested users’ recovery phrases and enabled attackers to drain funds, with losses already estimated above 7 million dollars. At the same time, extensions branded as “Chat GPT for Chrome” and “AI Sidebar with Deepseek” were exposed as spyware, silently exfiltrating private AI chats and session tokens from more than 900,000 users. Other extensions, such as ones named “Phantom Shuttle,” hijacked browser traffic and routed it through attacker controlled servers to steal logins for social and education platforms. At least 35 legitimate extensions were also compromised after developers were phished, letting attackers inject code that stole session cookies and account access. ⚙️ How It Works • Weaponized updates - Attackers get access to a developer account or API key, then push a malicious update to an existing extension that users already trust and have installed. • Seed phrase and wallet theft - In the Trust Wallet case, the rogue version captured private recovery phrases and used them to empty wallets, even if users never typed those phrases recently.