A Chrome extension that Google removed in January 2026 for stealing AI chat conversations is back on the Chrome Web Store, and it is reaching enterprise browsers through Google's own CRX distribution infrastructure. Netskope Threat Labs detected and blocked the latest build arriving at endpoints via Google's CDN, classifying it as Trojan.GenericFCA.Script.37952. If your users install browser extensions without approval gates, this one has a plausible path onto their machines. Details in this article come from analysis published by SecurityWeek.
The extension is named 'AI Sidebar with DeepSeek, ChatGPT, Claude and more' and markets itself as an AI assistant. OX Security flagged it in December 2025 for scraping ChatGPT and DeepSeek conversation content and sending it to external domains. That means whatever staff typed into those chat windows, including client details, contract language, source code, or internal financials, was being copied off the machine.
The extension amassed over 300,000 installs and a 4.6-star rating on the Chrome Web Store before Google pulled it.
The conversation-theft code disappeared from later builds, and the extension's privacy policy now references the earlier conduct. As of August 2026 the listing is live again, and Netskope says enterprise endpoints are receiving updates carrying a different payload. Version 1.7.2.0, pushed between July 20 and 31, 2026, shipped clean functionality that appears intended to build a trustworthy update history. Version 1.7.3.0 followed about two weeks later with a 21-line addition to a single script file.
The listing attributes the developer name to DeepSeek AI, which is false. The extension's own files name Extchange.com as both developer and data controller, using a domain registered in February 2024 with no public registrant information.
Nothing here is a flaw in Chrome, ChatGPT, Claude, or DeepSeek. This is a supply chain problem in the extension layer, where a third party you never vetted pushes code updates directly into your users' browsers with the permissions they already granted.
What AI Sidebar Stole and Why Threat Actors Target Conversation Data
The original malicious behavior in this extension was conversation scraping: pulling the content of ChatGPT and DeepSeek sessions out of the rendered page and sending it to external domains. That matters more than the volume of installs, because of what your staff actually type into an AI assistant during a working day.
A prompt window is where employees paste the things they do not want to retype. In practice, the contents of your organization's AI chat history look like this:
- Source code and configuration snippets, frequently including API keys, database connection strings, and tokens left inline because the developer was debugging, not publishing
- Draft commercial material: pricing models, proposal language, contract clauses, and internal strategy memos being rewritten or summarized
- Customer and employee personal data, pasted in to be reformatted, translated, or turned into a summary
- Financial figures and forecasts dropped into a chat to be explained or converted into a narrative
- Internal system detail: error messages, log excerpts, hostnames, and architecture descriptions used to ask for troubleshooting help
Your developers are the most exposed group. A key pasted into a chat window is a live key, and anyone holding it authenticates as an authorized service, so the resulting activity looks legitimate in your cloud and application logs.
Knowledge workers and business users carry a different exposure. Conversation data is already summarized and labeled by the person who wrote it, which is what makes it valuable to an attacker compared with a raw file dump. Someone reading your team's prompts learns which deal is being negotiated, which client is unhappy, and who signs off on payments, all in plain language and without needing to correlate anything.
That context feeds directly into pretexting and business email compromise. An attacker who has read a month of your finance team's AI conversations can write an invoice query in your own internal phrasing, referencing a real vendor and a real project.
The compliance angle is worth reading carefully. The extension's own files list Extchange.com as both developer and data controller, with a domain registered in February 2024 and no public registrant information. If personal data belonging to your customers or staff passed through that extension, you have a disclosure to a third-party controller you never assessed, never contracted with, and cannot name in a records-of-processing entry or a data subject request response.
Under GDPR that is a processing relationship you never established. Under CCPA and comparable state privacy laws it is a disclosure of personal information to an unknown recipient. Regulated sectors add their own layer: health data, client-privileged material, and financial records pasted into a chat window inherit the same obligations they had in your file server.
The exfiltration route also affects what you can reconstruct afterward. Data taken from inside a browser tab does not pass through your mail gateway or your file-sharing platform, so the systems you would normally query during an investigation hold no record of what left. Scoping a notification decision becomes an exercise in reconstructing what people typed.
Netskope treats the current affiliate-referral payload as low-stakes and points out the more serious issue: the same update channel that delivered a monetization script has previously delivered conversation theft, and it reaches enterprise endpoints as a trusted update.
How Extchange.com Distributes the Malicious Extension and Evades Detection
The distribution model here is a two-stage release, and the timing is the most useful artifact for threat hunters. Version 1.7.2.0 shipped between July 20 and 31, 2026 with clean functionality and no monetization code, which established an update history that looked ordinary to both users and store review. Version 1.7.3.0 arrived roughly two weeks later carrying a 21-line addition to a single script file, small enough that a diff-based review of the package would show almost no change in footprint.
Packaging relies on identity confusion at the listing level. The extension's own files name Extchange.com as both developer and data controller, while the Chrome Web Store listing displays the developer as DeepSeek AI. That is masquerading in the ATT&CK sense (T1036.005, match legitimate name or location), and it is what carries the package past a user who checks the publisher field before clicking install. The Extchange.com domain was registered in February 2024 and carries no public registrant information, so there is no corporate entity for a procurement team to evaluate.
Execution runs out of the extension's service worker, the persistent background script in a Manifest V3 extension. The worker subscribes to Chrome's runtime lifecycle events and, when the browser reports that the extension has updated, opens an affiliate link in a new foreground tab. Code comments in the added block explicitly specify that the trigger should fire on update and not on install. That choice converts every future version bump into a fresh referral payout instead of a single one-time commission, which is why the operator has an incentive to keep publishing releases.
The redirect chain runs through a URL shortener before landing on an AI video-generation platform that operates a public affiliate program. The shortener hop is the part worth logging, because it hides the destination from casual inspection of the extension source and gives the operator a pivot point to swap the endpoint without shipping new code to the browser.
The uninstall path abuses a Chrome behavior where only the most recently registered uninstall URL is honored. The legitimate code in the extension registers its own URL at load, and the added block overwrites that registration five seconds later. A user who removes the extension still generates a referral on the way out, so the operator monetizes removal as well as retention. For a business, this means the browser opens attacker-chosen web destinations during routine software events that no one treats as security-relevant.
Delivery reached enterprise endpoints through Google's own content delivery network as a routine extension update, which is why perimeter controls that trust update traffic did not stop it. Netskope Threat Labs detected and blocked version 1.7.3.0 in transit and classified the script as Trojan.GenericFCA.Script.37952. The firm reported the listing to the Chrome Web Store before publishing.
The evasion story is straightforward. The behavior that triggered the original takedown was stripped from later builds, the privacy policy was updated to reference the earlier conduct, and the listing was reinstated on a record that looked remediated. New code then arrived post-reinstatement through the update channel. Netskope described the affiliate scheme as low-stakes on its own and noted that the same channel could carry a more damaging payload in a future release.
Artifacts worth pinning for hunting:
- Extension versions
1.7.2.0(July 20 to 31, 2026) and1.7.3.0 - Developer and data controller string Extchange.com in extension files, listing publisher shown as DeepSeek AI
- Extchange.com domain registration date February 2024, registrant privacy-shielded
- Service worker tab-open on runtime update event, and uninstall URL re-registration five seconds after load
- Outbound shortener redirect to an AI video-generation affiliate endpoint
Immediate Detection and Removal for Affected Users and Organizations
Remove the extension first, before you start investigating. Open chrome://extensions on each affected machine, enable Developer mode to reveal each extension's ID string, and record that ID for the AI Sidebar listing before you delete it. You will need the ID for fleet-wide searching, and it disappears from the page once the extension is gone.
Watch for name variants during the sweep. The Chrome Web Store listing displays the developer name as DeepSeek AI, so a user scanning their extension list for something suspicious sees what looks like a first-party vendor entry. Search on the ID rather than the display name.
Expect a browser tab to open during removal. The uninstall handler was rewritten five seconds after page load so that pulling the extension still routes a referral through a URL shortener to an AI video-generation platform. Close that tab without clicking through, and capture the shortener domain from your proxy logs while you have it, since it becomes a hunting indicator for the rest of the fleet.
After uninstall, clear the browser profile's cached data and site storage for the AI platforms the extension had access to, then sign the user out of every active ChatGPT and DeepSeek session and force a fresh login. Extension storage is removed with the package, but tokens held in the page context are not.
Finding the rest of the installs
If you run Chrome Enterprise cloud management, pull the extension inventory report across enrolled profiles and filter on the recorded ID. That report is the fastest fleet-wide answer, and it catches machines where the user never mentioned installing anything.
For unenrolled or BYOD endpoints, work backwards from network telemetry. Look for outbound requests to the shortener and the affiliate destination that fire immediately after a Chrome extension update event, especially in a foreground tab the user did not open. Your web proxy or DNS logs will show that pattern even where you have no browser management at all.
Short-term hardening
- Move from blocklisting to an explicit allowlist with
ExtensionInstallAllowlist, then setExtensionInstallBlocklistto*so anything not approved cannot install. - Block developer-mode sideloading and unpacked extension loading through policy, which closes the path a user takes when the store version is unavailable.
- Require a named approver for AI assistant extensions specifically, since these request read access to page content on the sites where your staff paste sensitive material.
The allowlist is the control that matters most here. A store removal and a store reinstatement are both decisions made outside your organization, and an allowlist means neither one changes what runs on your endpoints.
Checking whether data left
Pull the account activity and session logs from your AI platforms and look for sessions from IP addresses or user agents that do not match the employee's normal pattern. Then review API key usage for any key that a developer may have pasted into a prompt while the extension was installed, looking for calls outside working hours or from unfamiliar regions.
Rotate anything that appeared in a chat window during the exposure period: API keys, database connection strings, service account passwords, and internal URLs. In environments Capstone manages, Adlumin flags the authentication anomalies that follow credential exposure, including logins to downstream systems from locations and devices that do not match the user's history.
Finally, add the extension ID to a recurring check so a reinstall surfaces within days instead of months. The same distribution channel can carry a different payload in the next release, and your detection should key on the publisher and the ID, not on the behavior you already cleaned up.
Protecting AI Workflows Against Supply-Chain Threats in Browser Extensions
The highest-value control is an allowlist. In Chrome Enterprise or Google Workspace policy, set ExtensionInstallBlocklist to * and then permit only reviewed extension IDs through ExtensionInstallAllowlist. That single change removes the install path that this campaign depended on, because a user clicking "Add to Chrome" on a store listing no longer decides what runs in your browsers.
Review permissions before an ID goes on that list, and review them again on every version bump. The permissions that matter for AI workflows are host access to the platforms your staff use and the ability to read or modify page content. An extension granted <all_urls> plus scripting can read the rendered text of any prompt and any response, which is functionally the same access your employee has.
Use ExtensionSettings to constrain the extensions you do approve. The runtime_blocked_hosts key stops an approved extension from touching specific domains even when its manifest asks for them, so a note-taking or grammar tool can be kept off your AI platforms and your internal web applications entirely. Pair that with ExtensionAllowedTypes so users cannot sideload unpacked code from local disk.
Favor extensions with published source and a real maintenance history, and check who owns the listing. Ownership changes hands, and a well-reviewed tool with a large install base is an attractive acquisition for someone who wants distribution. Your allowlist entry should record the developer name, the publish date, and the permission set at the time of approval, so a change in any of the three triggers a fresh look.
Separate the browsing that touches sensitive material from everything else. A dedicated Chrome profile for AI work, sales tooling, and financial systems, running with zero extensions, costs almost nothing to deploy and removes an entire class of page-content theft. Route untrusted general browsing through an isolated session so that anything installed there never shares a process with your production tabs.
Treat every extension with read access to an AI platform as a data processor with standing access to whatever your staff paste into a prompt window.
On the network side, require that ChatGPT, Claude, and similar platforms be reached only from managed browsers with egress through an inspecting proxy. That gives you two things you cannot get from the endpoint alone: visibility into which process is talking to the AI platform, and a DLP inspection point for prompt content leaving your organization. Log and review outbound traffic to URL shorteners and recently registered domains, since redirect chains are how affiliate and exfiltration traffic hides its real destination.
Apply least privilege and continuous verification to the extension estate the same way you apply it to service accounts. Approval is not permanent. Schedule a quarterly re-review of every allowlisted ID, alert on version changes for extensions that hold host permissions on sensitive domains, and set an expiry date on approvals for anything installed for a short-term project.
Give your users a supported path as well. Publish a short list of approved AI assistants and a request process with a stated turnaround, because staff who cannot get a tool approved in reasonable time will find one that does not require approval. Start with the allowlist policy this week, then work through the permission review of what is already deployed.
What Organizations Should Do Now and Over the Next 30 Days
The payload in the current build is affiliate fraud. A service worker opens a shortened affiliate link to an AI video-generation platform when Chrome reports an update, and the code comments show the trigger was deliberately set on update instead of install so every future release earns a new commission. The uninstall path overwrites the legitimate uninstall URL five seconds after load, so removing the extension still pays the operator.
That is a small financial harm. The part worth your attention is that the same publisher already used this listing to exfiltrate conversation content, lost store access over it, and got the listing back. Netskope's own assessment is that this channel could carry a more damaging payload on the next release.
Your first question today is not technical. It is whether anyone in your organization owns the decision about what runs inside your browsers. In most firms that ownership is unassigned, which is why a listing showing a developer name of a well-known AI vendor, backed by a domain registered in February 2024 with no public registrant details, reached enterprise endpoints without anyone raising a question.
Over the next month, the useful exercise is reconstructing how it got installed in your environment: who installed it, what they were trying to accomplish, and whether an approved alternative existed. That tells you whether you have a user awareness gap, a tooling gap, or a policy gap.
Treat browser extensions as third-party software from unvetted vendors, because that is what they are. Until extension installs go through the same review as any other purchased software, this pattern repeats under a different listing name.
