Hidden trouble in Chrome AI tools
Many people trusted AI extensions in the Google Chrome Web Store, hoping for smart shortcuts and faster browsing. Security researchers say a coordinated campaign of roughly 30 fake AI extensions accumulated hundreds of thousands of installs, as media reports cite about 260,000 confirmed installs across the identified extensions, with some outlets aggregating related downloads to more than 300,000.
Researchers later found the extensions copied text from websites people opened, including emails and work platforms. Since everything happened quietly in the background, most users kept browsing normally while their information was sent to remote servers controlled by attackers.
How fake tools fooled Chrome users
The fake extensions blended in with real AI tools that people download every day. Their names sounded familiar and helpful, and the features they offered made sense, so users didn’t think twice before clicking install.
Once installed, the extensions performed the tasks they promised, which helped hide the danger. While people worked, studied, or checked accounts, the extensions quietly collected page content and user activity, sending it away without showing any obvious signs.
Why were Google Chrome Web Store users targeted
Attackers knew the Google Chrome Web Store felt safe to many users, so placing fake AI tools there made people trust them quickly. The extensions copied the style of popular AI products to appear legitimate.
They captured text from every page opened, including Gmail, online forms, and private dashboards. Some even accessed email drafts before they were sent, turning everyday browsing into a silent data leak that users couldn’t easily detect.
AI buzz made scams easier to spread
AI-themed tools have become extremely popular, and criminals have taken advantage of the excitement. Many users saw names like AI Assistant or ChatGPT Translate and assumed they were genuine productivity helpers.
By riding the wave of AI interest, these extensions spread quickly. People installed them hoping for smarter browsing, not realizing they were allowing hidden trackers to watch everything they typed, clicked, and viewed across different sites.
Little-known fact: Chrome didn’t start with Google’s top leaders’ full support early on; even Google’s CEO didn’t want to build a browser, but founders Larry Page and Sergey Brin pushed it through, and it became one of the most used programs ever.
The kind of data these tools stole
Researchers discovered the extensions pulling page text, titles, and metadata from nearly every site a user opened. This included personal accounts, work files, and pages protected by logins.
Some extensions had special code designed to read Gmail content directly. That meant incoming messages, drafts, and sensitive conversations were gathered quietly, creating a large and valuable stream of personal and corporate information for scammers.
How spying happened inside the browser
The extensions used a reading library to scan whatever appeared on the screen. It acted like a quiet observer, copying words and details without interrupting anything the user was doing.
After gathering the information, the extensions sent it to outside servers through hidden browser windows. Because the tools still performed regular AI tasks, most people had no idea their data was being taken.
Little-known fact: Chrome runs each tab like its own mini computer instead of grouping everything together. Chrome isolates tabs into separate processes, so a crash in one doesn’t crash the whole browser.
Remote updates kept attackers hidden
Most browser tools rely on official updates, but these malicious extensions load their main features from outside servers. That lets attackers change how the tool behaves at any moment.
By updating content remotely, they avoided reviews that might expose them. The extension could start collecting new types of information or adjust its methods, all while appearing unchanged to people who had already installed it.
The most downloaded fake AI add-ons
Some of the malicious extensions became surprisingly popular. Researchers’ data (summarized in press reports) lists AI Sidebar at roughly 70,000 installs and AI Assistant at about 60,000 installs among the more popular malicious add-ons. These counts come from the LayerX dataset and subsequent media coverage; cite the report when publishing.
Others like ChatGPT Translate, AI GPT, and a fake Google Gemini also pulled in large numbers. Across all thirty extensions, downloads passed 300,000, giving attackers a huge pool of stolen data.
Why Gmail was a key target
Email holds valuable information like personal messages, business plans, and account security details. Attackers designed several extensions to read Gmail screens fully and quietly.
They could capture drafts, ongoing conversations, and message previews. Since many people keep Gmail open all day, this provides a steady stream of sensitive information for scammers to collect and use.
Who faced the biggest risks?
Anyone who installed a malicious extension was exposed, from teens checking school updates to workers handling private business files. Their everyday browsing became a source of information for attackers.
People working on company systems had even more to lose. Private dashboards, documents, and internal messages viewed in the browser could all be copied, creating risks for entire workplaces, not just individuals.
Warning signs users often miss
Many harmful extensions ask for broad permissions that don’t match their purpose, like reading all content on visited sites. Users sometimes accept these requests quickly without asking why the tool needs them.
If an extension feels overly intrusive or isn’t clear about its functions, that’s a strong signal to avoid it. Taking a moment to review permissions can prevent serious privacy problems later.
Steps to take if you installed one
If you recognize any of the suspicious tools, remove them immediately from your browser settings. After that, update passwords for important accounts, including email and banking.
It also helps to enable two-factor authentication for extra security. Even if attackers captured some login details, the added step makes it much harder for them to break into your accounts.
If you use Chrome extensions regularly, this warning hits even closer to home than you might think. See why Chrome users were warned after an extension was caught harvesting AI prompts and find out what data these tools are secretly collecting from your AI conversations.
Staying safe with browser extensions
Extensions can be useful, but they also gain deep access to your online activity. Choosing them carefully protects your privacy and reduces the risk of hidden tracking.
Install only tools from trusted developers, read recent reviews, and limit how many you use. A few small habits can keep your browser secure and prevent your information from falling into the wrong hands.
Choosing extensions carefully is smart, and Google’s latest picks can help you find the good ones. Check out the 10 Chrome extensions Google highlighted in 2025 and see which tools made the cut for quality, security, and genuine usefulness.
Have you ever found a sketchy browser extension on your device? Share your experience below, and hit like if this helped you stay safer online.
This slideshow was made with AI assistance and human editing.
Don’t forget to follow us for more exclusive content right here on MSN.
Read More From This Brand:
Lucky you! This thread is empty,
which means you've got dibs on the first comment.
Go for it!