{"id":148,"date":"2026-10-29T07:10:31","date_gmt":"2026-10-29T07:10:31","guid":{"rendered":"https:\/\/bugskan.com\/?p=148"},"modified":"2026-10-29T07:10:31","modified_gmt":"2026-10-29T07:10:31","slug":"malicious-ai-browser-extensions-copied-legitimate-tools-to-collect-conversations","status":"publish","type":"post","link":"https:\/\/bugskan.com\/index.php\/2026\/10\/29\/malicious-ai-browser-extensions-copied-legitimate-tools-to-collect-conversations\/","title":{"rendered":"Malicious AI browser extensions copied legitimate tools to collect conversations"},"content":{"rendered":"<p>Dark Reading reported in January 2026 on OX Security\u2019s investigation of two malicious Chrome extensions posing as AI sidebars. The extensions copied legitimate functionality while collecting conversation and browsing information for an external server.<\/p>\n<p>The listings showed a combined audience exceeding 900,000 users, but install counts do not establish the exact number of people whose data was stolen. The report said both extensions had been removed.<\/p>\n<p>Review installed extensions and their publishers, permissions and update history. If an affected extension was present, remove it and assess what conversations or account information it could access. A familiar AI brand in an extension title is not evidence of endorsement.<\/p>\n<p><a href=\"https:\/\/darkreading.com\/cloud-security\/fake-ai-chrome-extensions-steal-900k-users-data\">Read the original source<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>OX Security\u2019s reported campaign used lookalike extensions; model-provider names in the listings did not make those providers the attackers.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"bugskan_incident_id":"inc_47bd75c68eeef0","bugskan_event_type":"breach","bugskan_response":"REVIEW","bugskan_technical_severity":"","bugskan_technical_severity_source":"","bugskan_evidence_quality":"medium","bugskan_affected_scope":"The two lookalike extensions identified in OX Security\u2019s reported investigation.","bugskan_recommended_next_step":"Review browser extensions and investigate exposure from any identified malicious extension.","bugskan_who_should_check":"","bugskan_material_updated_at":"2026-01-08T00:00:00Z","bugskan_reviewer_name":"","bugskan_reviewed_at":"","bugskan_legacy_state":"mapped","bugskan_featured":false,"bugskan_sample":false,"footnotes":""},"categories":[1],"tags":[],"bugskan_format":[2],"bugskan_technology":[],"class_list":["post-148","post","type-post","status-publish","format-standard","hentry","category-uncategorized","bugskan_format-security-brief"],"_links":{"self":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/148","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/comments?post=148"}],"version-history":[{"count":1,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/148\/revisions"}],"predecessor-version":[{"id":357,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/148\/revisions\/357"}],"wp:attachment":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/media?parent=148"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/categories?post=148"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/tags?post=148"},{"taxonomy":"bugskan_format","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_format?post=148"},{"taxonomy":"bugskan_technology","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_technology?post=148"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}