260,000 Chrome Users Exposed by Fake AI Extensions Targeting Gmail

More than 260,000 Chrome users unknowingly installed browser extensions labeled as a helpful AI assistant. According to researchers at LayerX, the coordinated campaign involved over 30 fake Chrome extensions posing as services similar to ChatGPT and Claude.

We have seen a fair share of malicious Chrome extensions since Google released the initial version of its browser. From fake VPN extensions and outright malicious extensions to sophisticated session replay malware. While marketed as AI productivity tools, new add-ons would deploy spyware that steals browsing and Gmail data.

How Fake AI Extensions on the Chrome Web Store Worked?

Researchers discovered that the malicious AI extensions shared nearly identical code, permissions, and backend infrastructure. Instead of appearing as separate tools with different names and branding, they relied on the same underlying structure.

Security researcher Natalie Zargarov explained that the campaign exploited users’ trust in AI interfaces:

“By injecting iframes that mimic trusted AI interfaces, they’ve created a nearly invisible man-in-the-middle attack that intercepts everything from API keys to personal data before it ever reaches the legitimate service.”

The attack was especially effective because it integrated into normal AI interactions, where users are already getting used to sharing detailed information.

The “AiFrame” extension Architecture Explained

At the core of the operation was what researchers call an “AiFrame” extension architecture.

Instead of embedding full functionality inside the extension code reviewed by Google during installation, the extensions:

• Loaded a full-screen iframe from remote domains (e.g., subdomains of tapnetic[.]pro)
• Overlaid the current webpage
• Acted as a fake AI interface
• Pulled instructions dynamically from backend servers

This setup allowed attackers to change behavior remotely without pushing an updated version to the Chrome Web Store. In other words, what users installed wasn’t necessarily what was running later.

The most downloaded of the malicious AI extensions used in the campaign

According to campaign data, the most widely installed extension linked to the AiFrame operation was Gemini AI Sidebar (ID: fppbiomdkfbhgjjdmojlogeceejinadg), which reportedly reached 80,000 users before being removed from the Chrome Web Store.

Despite that removal, BleepingComputer identified several additional extensions that remain available in Google’s Chrome extension repository. While some of these add-ons use different public names, their extension IDs confirm they are part of the same broader campaign.

Examples include:

• AI Sidebar (gghdfkafnhfpaooiolhncejnlgglhkhe) – 70,000 users
• AI Assistant (nlhpidbjmmffhoogcennoiopekbiglbp) – 60,000 users
• ChatGPT Translate (acaeafediijmccnjlokgcdiojiljfpbe) – 30,000 users
• AI GPT (kblengdlefjpjkekanpoidgoghdngdgl) – 20,000 users
• ChatGPT (llojfncgbabajmdglnkbhmiebiinohek) – 20,000 users
• AI Sidebar (djhjckkfgancelbmgcamjimgphaphjdl) – 10,000 users
• Google Gemini (fdlagfnfaheppaigholhoojabfaapnhb) – 10,000 users

Security researchers at LayerX analyzed the extensions and determined that all 30 identified add-ons share an identical internal architecture. This includes the same JavaScript codebase, permission structure, and backend infrastructure.

Gmail was a Primary Target via injected iframes

Fifteen of the malicious extensions specifically targeted Gmail users.

These versions:

• Activated at document_start on mail.google.com
• Injected interface elements into Gmail’s interface
• Used MutationObserver scripts to persist within dynamic pages
• Accessed email threads and, in some cases, draft content
• Transmitted extracted data back to remote servers

Because the extensions had <all_urls> permissions, they could also access data across nearly any site a user visited (including enterprise dashboards and SaaS platforms).

Enterprise Risks and Data Exfiltration

The concern extends beyond just simple users. These extensions effectively acted as remotely controlled access brokers.

By combining privileged browser permissions with backend-controlled interfaces, attackers were able to:

• Scrape structured page data using Mozilla’s Readability library
• Extract titles, article text, and metadata
• Capture sensitive enterprise data inside authenticated sessions
• Transmit data outside intended browser security boundaries

The infrastructure behind the campaign relied on themed subdomains under tapnetic[.]pro, with rapid “extension spraying” tactics. When one extension was removed from the Chrome Web Store, nearly identical copies appeared shortly afterward under new identifiers.

Why Fake AI Extension Attack Is Different?

What makes fake AI extension campaign different isn’t just scale.

Modern browser extensions have access levels similar to endpoint software. When combined with:

• Automatic updates
• Remote content loading
• Broad site permissions

They become powerful spy mechanisms. Because much of the malicious logic lived remotely, enforcement actions against individual extensions had limited impact.

Strategies for Detecting and Preventing Unauthorized Network Access

Security experts recommend a layered defense approach you can implement in your organization today:

1. Restrict Extension Installations. Allow only vetted browser add-ons through enterprise policy controls.
2. Monitor High-Risk Permissions. Flag extensions requesting <all_urls>, cookie access, or content script injection.
3. Monitor Telemetry . Watch for unusual DOM scraping, iframe injection, and suspicious outbound connections.
4. Enforce Network Controls. Use DNS filtering, egress monitoring, and data loss prevention (DLP).
5. Strengthen Identity Protections. Implement MFA, device trust policies, and least-privilege access.
6. Audit Regularly. Conduct threat hunting and browser configuration reviews to detect extension spraying.

A Growing AI-Themed Threat

To me, this campaign shows a broader trend: hackers are using the trust and popularity of AI tools to their advantage.

As AI assistants become deeply integrated into daily work, attackers are increasingly mimicking their interfaces to collect sensitive information.

For users and enterprises alike, the lesson is clear:
"Browser extensions deserve the same scrutiny as installed software."