Malicious AdBlocker Extensions Steal AI Chat Data from 90,000 Users

Two Chrome extensions disguised as adblockers—Smart Adblocker (80k users) and Adblock for Browser (10k users)—intercept and exfiltrate prompts and responses from AI platforms including ChatGPT, Claude, Gemini, Copilot, Grok, Perplexity, DeepSeek, and Meta AI to attacker-controlled servers. The extensions also check paid user status on five of these platforms. Both extensions share the same malicious infrastructure, including a capture engine and payload format. A detailed report with IOCs, remote configurations, and reproduction steps is available.