Victims who installed the extension got all the advertised features, as the original code is still there. Those who clicked on the advertised results landed on a fake “ChatGPT for Google” page, first, then on the extension’s page on Chrome’s official store. This can lead us to the conclusion that hackers may also have a “Plan C” in mind, meaning another fake extension, to continue this campaign. Cybercriminals decided to activate it after the official store removed the first fake extension. As earlier this month another fake ChatGPT Chrome add-on was released and lurked 4,000 people before its removal.īoth versions used the same infrastructure to communicate and it is not excluded that this new attempt is in fact a backup. This fake extension seems to be part of a larger campaign. This led to almost a thousand downloads daily from people that are searching for “ChatGPT 4.”. But threat actors started to advertise it in Google Search results only on March 14, 2023. Researchers at Guardio Labs say that the extension was published on the Chrome Web Store on February 14, 2023. Details About This Fake ChatGPT Extension Since its release, the trojanized version had over 9,000 downloads. The malicious extension is a copy of “ChatGPT for Google”, a Chrome add-on, but with additional malicious code. This version steals Facebook session cookies, hijacking accounts. Researchers discovered a new fake ChatGPT extension for Chrome in the official Chrome Store.

Protonvpn extension for chrome