{
  "Event": {
    "analysis": "1",
    "date": "2026-06-03",
    "extends_uuid": "",
    "info": "[Threat Intel] Browser Spy-Ons: Threat Actor's Extension Hijack Your AI Conversations",
    "protected": false,
    "publish_timestamp": "1780629633",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1780629632",
    "uuid": "dd04fd2f-6f98-44c7-8245-420da214bf24",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#6af4de",
        "local": false,
        "name": "misp-galaxy:producer=\"G DATA\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#e96364",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Adversary-in-the-Middle - T1557\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d38fc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Acquire Infrastructure - T1583\"",
        "relationship_type": ""
      },
      {
        "colour": "#ff841f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#20f80d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"",
        "relationship_type": ""
      },
      {
        "colour": "#9e0269",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#1acf09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Trusted Relationship - T1199\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005c",
        "local": false,
        "name": "rectifyq:topic=\"ai\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780570814",
        "to_ids": false,
        "type": "link",
        "uuid": "81e9cc0b-3d85-44be-a46b-760120edb0e9",
        "value": "https://blog.gdatasoftware.com/2026/06/38428-browser-addons-spy-on-ai-chats"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780570814",
        "to_ids": false,
        "type": "text",
        "uuid": "691d3d43-df04-4838-a79a-6acf57bc88a5",
        "value": "Multiple malicious Chrome extensions are exploiting the growing use of AI platforms by disguising themselves as legitimate productivity tools while secretly stealing user conversations and personal data. Extensions including Urban VPN, Smart Sidebar, and AI Assistant/Chat AI collectively reach millions of users but contain hidden scripts that intercept communications with popular AI platforms like ChatGPT, Claude, DeepSeek, Gemini, and others. These extensions inject malicious JavaScript that overrides network requests, monitors DOM elements for chat interactions, and exfiltrates sensitive data including conversation content, session identifiers, and timestamps to remote servers. The threat is particularly concerning as users frequently share confidential personal, medical, and corporate information with AI platforms, making intercepted conversations highly valuable for threat actors."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780570814",
        "to_ids": false,
        "type": "text",
        "uuid": "67b7dcdd-78fa-4e04-9315-337f13045480",
        "value": "Name: Browser Spy-Ons: Threat Actor's Extension Hijack Your AI Conversations\nAuthor: AlienVault\nAdversary: \nTags: [\"chrome extensions\", \"javascript injection\", \"privacy breach\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: [\"T1557\", \"T1583\", \"T1132.001\", \"T1056.001\", \"T1539\", \"T1074.001\", \"T1071\", \"T1176\", \"T1005\", \"T1140\", \"T1036\", \"T1185\", \"T1112\", \"T1059\", \"T1102\", \"T1041\", \"T1199\", \"T1027\", \"T1189\", \"T1071.001\"]\nIndustries: []"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780624084",
        "uuid": "d569f3d6-aac5-409b-b67a-cf9268f8aeb1",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780624084",
            "to_ids": true,
            "type": "md5",
            "uuid": "7ee67e59-81f2-462d-80e4-8ff4058af976",
            "value": "2e1386682846cd60afa6062ea088b782",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780623462",
            "to_ids": true,
            "type": "sha1",
            "uuid": "b60b07b2-f281-4e71-b17b-07edc67d965a",
            "value": "445baa512ca9242a19e17bf665427d0d84ffd031",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780623462",
            "to_ids": true,
            "type": "sha256",
            "uuid": "019a6893-8982-4ca0-85ab-37341cbaba5d",
            "value": "524c953e23ff8b768206cf33a529c11ac5510e47cbf6246db79ee671d1231716",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780621881",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "a8c0f9c2-39c2-4dc5-a91b-1bbc8b90d962",
            "value": "3072:sbsmn1Q7dFnt4PI/U5J1XEiVB+e22PELVOq5Y6R4Fi5ZVOf:s4m1Q7dFnt4PI/UH1XRuYEY6C"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780621881",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "cb2ada90-626b-4665-ba21-4a74ba8a87c3",
            "value": "249541"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780621881",
            "to_ids": true,
            "type": "vhash",
            "uuid": "563f6250-2ec8-4fc9-ac59-f653f02ff3cd",
            "value": "e6d35eab1b1008adff021bae65f559cc"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780621881",
            "to_ids": true,
            "type": "filename",
            "uuid": "73393991-1417-413e-8c41-9f7055c38940",
            "value": "content.js"
          },
          {
            "category": "Other",
            "comment": "Checked: 05/06/2026\nLast-scan\t:  25/03/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780621881",
            "to_ids": false,
            "type": "text",
            "uuid": "a221e86f-11b2-43d4-ae42-128565cbc4e6",
            "value": "Type Description: JavaScript\nMicrosoft: Trojan:JS/Phish!MSR\nVT Total Detection:11/62\nFirst Submission:2025-12-09T13:26:38.000000+00:00\nLast Submission:2026-04-11T22:26:20.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780624106",
        "uuid": "67f6b288-c39c-4623-bc4e-0ccc35bd2894",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780624106",
            "to_ids": true,
            "type": "md5",
            "uuid": "7bf4d82f-73bb-4817-a7e3-0f9680448501",
            "value": "d5f9660fe994423d9aa9031664718e89",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780623464",
            "to_ids": true,
            "type": "sha1",
            "uuid": "6706ba65-1787-4c68-9fd6-fcbcb58c0866",
            "value": "1f0e43dfd6ff5419c62544f9979b0b3445b7eff9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780623464",
            "to_ids": true,
            "type": "sha256",
            "uuid": "15873351-4c31-4a39-9234-5b35d9899cab",
            "value": "c984787ccd787629542da68302ed4ceb48fc7e458eab1c15bf45c3070883d26a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780621902",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "b8ece404-c2d2-428f-b343-1c1f40d7b640",
            "value": "48:f1zuxekW/wmRMM8AGrJ+5J4RXHVzIfWBWcpFbAqTMy9vDH:dzux6/wm1GrRX1zuw1pH"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780621902",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "421664fb-e83a-4afe-806a-19dafd1e9c75",
            "value": "4849"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780621902",
            "to_ids": true,
            "type": "vhash",
            "uuid": "efae7ac1-a329-4b06-a7ab-d4cbebe91f99",
            "value": "9b22d553b4b4d8035b6d4dedc0f6aa49"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780621902",
            "to_ids": true,
            "type": "filename",
            "uuid": "0d33f6a5-6179-452c-b087-5cc76e970550",
            "value": "aiResponder.js"
          },
          {
            "category": "Other",
            "comment": "Checked: 05/06/2026\nLast-scan\t:  04/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780621902",
            "to_ids": false,
            "type": "text",
            "uuid": "5dc8ec90-6151-4d2b-b818-dc5c6daeef68",
            "value": "Type Description: JavaScript\nMicrosoft: Trojan:Script/Wacatac.B!ml\nVT Total Detection:20/61\nFirst Submission:2025-09-25T11:53:02.000000+00:00\nLast Submission:2026-02-13T17:22:31.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780624128",
        "uuid": "487f39dd-2024-47cb-8700-a824a5732a91",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780624128",
            "to_ids": true,
            "type": "md5",
            "uuid": "b7b1af3f-b8f9-4ba1-b6f6-66b24bb56b5b",
            "value": "d54878ad7acb8605919b9772a70d7ce9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780623465",
            "to_ids": true,
            "type": "sha1",
            "uuid": "86ea4c70-9fa0-4fa8-bacf-05b9ed41c82b",
            "value": "425496272233b346b9057292d13ad31e2423b1cb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780623465",
            "to_ids": true,
            "type": "sha256",
            "uuid": "6c39341e-0ed1-41d9-b522-67628397e35e",
            "value": "f8cbe44fde6914bc8d06426c03c92ed536c891470292e567a586b54af29c2442",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780621924",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "0f1c51c2-3f29-4a82-8948-51ba955b593f",
            "value": "48:0eQLoI+a2iVU7wvIWwI694MrsmboY2s6Y44UAjifgTz/w:0eQLoI+a2iVU7wkdksHjR3/w"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780621924",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "a1ca5161-fe2c-4152-82c8-f6df036be9b3",
            "value": "1751"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780621924",
            "to_ids": true,
            "type": "filename",
            "uuid": "7f4d168f-21df-4c03-8652-42207c1eda04",
            "value": "index.js"
          },
          {
            "category": "Other",
            "comment": "Checked: 05/06/2026\nLast-scan\t:  29/03/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780621924",
            "to_ids": false,
            "type": "text",
            "uuid": "45e9b5ee-9fc3-4d4e-84ba-2c422536a814",
            "value": "Type Description: Java\nMicrosoft: None\nVT Total Detection:16/61\nFirst Submission:2026-02-24T08:33:26.000000+00:00\nLast Submission:2026-02-24T08:33:26.000000+00:00"
          }
        ]
      }
    ]
  }
}