Two Chrome Extensions Caught Stealing ChatGPT and DeepSeek Chats from 900,000 Users

The malicious extensions exfiltrate user conversations and Chrome tab URLs to remote C2 servers every 30 minutes. They use DOM element scraping to extract chat messages from web pages and store them locally before transmitting to command and control servers. The extensions hijack native browser APIs like fetch() and XMLHttpRequest() to gather conversation data. They load remote configuration files with custom parsing logic for ChatGPT, Anthropic Claude, Google Gemini, and Perplexity. The threat actors use Lovable AI-powered web development platform to host privacy policies and infrastructure components to obfuscate their actions.