{“lastseen”:”2026-01-28T16:05:10″,”description”:”Researchers discovered **16** malicious browser extensions for Google Chrome and Microsoft Edge that steal ChatGPT session tokens, giving attackers access to accounts, including conversation history and metadata.\\n\\nThe 16 malicious extensions (15 for Chrome and 1 for Edge) claim to improve and optimize ChatGPT, but instead siphon users\u2019 session tokens to attackers. Together, they have been downloaded around 900 times, a relatively small number compared to other malicious extensions.\\n\\nDespite benign descriptions and, in some cases, a \u201cfeatured\u201d badge, the real goal of these extensions is to hijack ChatGPT identities by stealing session authentication tokens and sending them to attacker-controlled backends.\\n\\nPossession of these tokens gives attackers the same level of access as the user, including conversation history and metadata.\\n\\nIn addition to your ChatGPT session token, the extensions also send extra details about themselves (such as their version and language settings), along with information about how they’re used, and special keys they get from their own online service. \\n\\nTaken together, this allows the attackers to build a picture of who you are and how you work online. They can use it to keep recognizing you over time, build a profile of your behavior, and maintain access to your ChatGPT-connected services for much longer. This increases the privacy impact and means a single compromised extension can cause broader harm if its servers are abused or breached.\\n\\nAccording to the researchers, this campaign coincides with a broader trend:\\n\\n\\u003e \u201cThe rapid growth in adoption of AI-powered browser extensions, aimed at helping users with their everyday productivity needs. While most of them are completely benign, many of these extensions mimic known brands to gain users\u2019 trust, particularly those designed to enhance interaction with large language models.\u201d\\n\\n## How to stay safe\\n\\nAlthough we always advise people to install extensions only from official web stores, this case proves once again that not all extensions available there are safe. That said, installing extensions from outside official web stores carries an even higher risk.\\n\\nExtensions listed in official stores undergo a review process before being approved. This process, which combines automated and manual checks, assesses the extension\u2019s safety, policy compliance, and overall user experience. The goal is to protect users from scams, malware, and other malicious activity. However, this review process is not foolproof.\\n\\nMicrosoft and Google have been notified about the abuse. However, extensions that are already installed may remain active in Chrome and Edge until users manually remove them.\\n\\n## Malicious extensions\\n\\nThese are the browser extensions you should remove. They are listed by Name \u2014 Publisher \u2014 Extension ID:\\n\\n * ChatGPT bulk delete, Chat manager \u2014 ChatGPT Mods \u2014 gbcgjnbccjojicobfimcnfjddhpphaod\\n * ChatGPT export, Markdown, JSON, images \u2014 ChatGPT Mods \u2014 hljdedgemmmkdalbnmnpoimdedckdkhm\\n * ChatGPT folder, voice download, prompt manager, free tools \u2014 ChatGPT Mods \u2014 lmiigijnefpkjcenfbinhdpafehaddag\\n * ChatGPT message navigator, history scroller \u2014 ChatGPT Mods \u2014 ifjimhnbnbniiiaihphlclkpfikcdkab\\n * ChatGPT Mods \u2014 Folder Voice Download \\u0026 More Free Tools \u2014 jhohjhmbiakpgedidneeloaoloadlbdj\\n * ChatGPT pin chat, bookmark \u2014 ChatGPT Mods \u2014 kefnabicobeigajdngijnnjmljehknjl\\n * ChatGPT Prompt Manager, Folder, Library, Auto Send \u2014 ChatGPT Mods \u2014 ioaeacncbhpmlkediaagefiegegknglc\\n * ChatGPT prompt optimization \u2014 ChatGPT Mods \u2014 mmjmcfaejolfbenlplfoihnobnggljij\\n * ChatGPT search history, locate specific messages \u2014 ChatGPT Mods \u2014 ipjgfhcjeckaibnohigmbcaonfcjepmb\\n * ChatGPT Timestamp Display \u2014 ChatGPT Mods \u2014 afjenpabhpfodjpncbiiahbknnghabdc\\n * ChatGPT Token counter \u2014 ChatGPT Mods \u2014 hfdpdgblphooommgcjdnnmhpglleaafj\\n * ChatGPT model switch, save advanced model uses \u2014 ChatGPT Mods \u2014 pfgbcfaiglkcoclichlojeaklcfboieh\\n * ChatGPT voice download, TTS download \u2014 ChatGPT Mods \u2014 obmo\u010dbankihdfckkbfnoglefmdgmblcld _(original: obdobankihdfckkbfnoglefmdgmblcld)_\\n * Collapsed message \u2014 ChatGPT Mods \u2014 lechagcebaneoafonkbfkljmbmaaoaec\\n * Multi-Profile Management \\u0026 Switching \u2014 ChatGPT Mods \u2014 nhnfaiiobkpbenbbiblmgncgokeknnno\\n * Search with ChatGPT \u2014 ChatGPT Mods \u2014 hpcejjllhbalkcmdikecfngkepppoknd\\n\\n\\n\\n* * *\\n\\n**We don\u2019t just report on threats\u2014we remove them**\\n\\nCybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.”,”published”:”2026-01-28T14:34:43″,”modified”:”2026-01-28T14:34:43″,”type”:”malwarebytes”,”title”:”Malicious Chrome extensions can spy on your ChatGPT chats”,”source”:””,”references”:””,”id”:”MALWAREBYTES:F1E26154F3B61EFD4A4F1701E0199256″,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.malwarebytes.com\/blog\/news\/2026\/01\/malicious-chrome-extensions-can-spy-on-your-chatgpt-chats”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-28T16:05:10″,”description”:”Researchers discovered **16** malicious browser extensions for Google Chrome and Microsoft Edge that steal ChatGPT session tokens, giving attackers access to accounts, including conversation history…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,115,13,33,7,11,5],"class_list":["post-37869","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-malwarebytes","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n