Chrome Extensions Caught Stealing ChatGPT Access

How safe are your business's browser tools? The recent wave of Chrome extensions stealing ChatGPT access can compromise sensitive company data. Learn more about it

How safe are your business's browser tools? The recent wave of Chrome extensions stealing ChatGPT access can compromise sensitive company data. Learn more about it here.

Why Established Platforms Still Pose Threats

We've all done it at some point, quickly installing a browser tool without properly reviewing its permissions. It's easy to assume the Chrome Web Store is safe since it's Google-backed, after all.

While the platform does have a review process to ensure compliance with developer program policies, it's not foolproof. According to Socket cybersecurity researchers, threat actors have recently managed to hide harmful code in extensions that claim to streamline the ChatGPT experience. If you have any software modules from the publisher "ChatGPT Mods," remove them immediately.

Stolen User Credentials Compromise Sensitive Data

These extensions don't deploy malware or attack your systems directly. Instead, they exploit a vulnerable web-based authentication process that verifies ChatGPT users. Here's how it works:

• Monitoring: Once a user installs the extension, it injects a script into chatgpt.com to automatically scan all outbound requests.
• Extraction: If a request contains authorization details and session token data, the extension steals the information.
• Data theft: The attacker uses the token to authenticate ChatGPT sessions under the victim's identity. They can now access chat histories and applications connected to the platform.

These Chrome extensions stealing ChatGPT access also have the ability to send metadata, usage telemetry, and backend-issued access tokens from the extension service to the threat actor's third-party server.

Cybercriminals Are Also Targeting E-Commerce Platforms

Businesses should also watch out for browser add-ons that secretly hijack affiliate links. One of the extensions in question is "Amazon Ads Blocker" published by "10Xprofit" on January 19, 2026. As the name suggests, it claims to allow users to browse Amazon without seeing sponsored content.

While it does block ads as advertised, it also has a hidden function: it replaces existing Amazon product affiliate codes with the developer's affiliate tag.

The Socket researchers further determined that Amazon Ads Blocker is part of a broader scheme comprising 28 other browser add-ons targeting AliExpress, Amazon, Best Buy, Shopify, Shein, and Walmart.

How Can Businesses Address These Browser Security Risks

Protect your digital systems from malicious Chrome extensions and ChatGPT data theft with the following steps:

• Stricter extension policies: Only allow pre-approved and vetted tools to discourage your workforce from installing phishing extensions.
• Automated security tools: Many specialized browser security solutions offer real-time monitoring and risk assessment of extensions. They can detect excessive permissions, such as access to all website data, clipboard content, or browser history.
• Scheduled audits: Frequently inventory all installed browser extensions across the organization to identify unauthorized, unused, or suddenly malicious, hijacked applications.
• Employee education: Train staff to recognize signs of unauthorized access, such as excessive permission requests or unexpected updates.

Empowering Businesses With Stronger Browser Security

By taking proactive steps, your business can avoid risks like Chrome extensions stealing ChatGPT access or compromising sensitive data. Secure browsing isn't just a technical issue; it's a business priority that protects your assets and builds lasting trust.

Used with permission from Article Aggregator

Originally published on BroadMAX Networks, used with permission from Article Aggregator.