Affiliate Fraud Meets AI Hijack: Malicious Chrome Extensions Target ChatGPT Users

The Dual Threat Posed by Malicious Browser Add-ons

A recent investigation has shed light on a concerning trend where threat actors are leveraging the trust users place in Chrome extensions to execute multi-faceted cybercrime campaigns. These malicious extensions operate on two primary fronts: passive revenue generation through affiliate link hijacking, and active data theft by compromising user sessions for high-value services, specifically ChatGPT.

Affiliate link hijacking is a subtle form of fraud where the extension monitors a user's web browsing. When the user visits a major e-commerce site (like Amazon, eBay, or various software vendor portals) and is about to complete a purchase, the extension silently replaces the legitimate affiliate ID associated with that click with the attacker’s own ID. This ensures the attacker receives the commission for sales they did not generate, diverting millions in potential revenue over time.

Compromising the AI Frontier: ChatGPT Session Theft

The more critical element of this campaign is the targeted theft of ChatGPT access. Researchers found that these extensions specifically look for active sessions on the chat.openai.com domain. Their modus operandi includes:

• Cookie Harvesting: Stealing active session cookies, which allows the attacker to bypass standard login credentials and impersonate the user.
• Unauthorized Access: Gaining full access to the compromised ChatGPT account, including viewing, modifying, and potentially extracting sensitive conversation histories.
• API Key Exposure: In cases where users might have configured API access via the web interface, there is a risk of exposing associated API keys, leading to further financial or data leakage consequences.

This type of account compromise is particularly alarming given that corporate users frequently input proprietary data or code snippets into AI chat platforms, believing the session is secure.

Technical Modus Operandi and Infiltration

These extensions typically use highly generic names and promise minor productivity enhancements, fooling users during the installation process. The core of their malicious activity relies on requesting overly broad permissions during installation, often including tabs, webRequest, and *://*/* (access to data on all websites).

Once installed, the extension uses background scripts to continuously monitor network traffic and URL navigation. When a target URL is hit (e.g., a major retailer or OpenAI), the background script injects a custom JavaScript file (a content script) into that page. This injected script is responsible for executing the payload—either swapping affiliate links or exfiltrating session tokens via a C2 (Command and Control) server.

Mitigation and Recommendations for CyberYuren Readers

To protect against these insidious attacks, cybersecurity professionals and general users must exercise extreme caution regarding browser add-ons:

• Permission Scrutiny: Always review the permissions requested by an extension. If a seemingly simple utility (e.g., a color picker or screenshot tool) requests permission to “Read and change all your data on all websites,” it should be immediately flagged as suspicious.
• Minimalism: Install the absolute minimum number of extensions required for your workflow. Fewer extensions mean a smaller attack surface.
• Regular Audit: Periodically review your installed extensions (via chrome://extensions) and remove any that are unfamiliar, unused, or were installed without conscious authorization.
• Source Verification: Prioritize extensions from highly reputable developers with high installation counts and recent, positive reviews that don't appear automated or generic.