Unit 42 Details Malicious Behaviors in 18 GenAI-Themed Chrome Extensions
Summary
Unit 42 analyzed 18 GenAI-themed Chrome extensions and found RAT, data-theft, search-hijacking and spyware behaviors, including email and API-key theft. Google removed extensions or warned owners; researchers recommend least-privilege controls and runtime monitoring.
Key points
- Unit 42 reported 18 high-risk Chrome extensions marketed as AI productivity tools to Google, which removed extensions or warned their owners.
- The Chrome MCP Server extension maintained WebSocket command-and-control and accepted more than 30 commands, including arbitrary JavaScript execution and Chrome Debugger Protocol access.
- Supersonic AI collected email content from rendered pages and sent it externally in plaintext; Unit 42 also observed an exposed one-time password in sandbox logs.
- Reverse Recruiting forwarded OpenAI, Gemini and Claude API keys, along with users’ profile and resume information, to a remote backend.
- Chat AI for Chrome hijacked the default search engine and used identifiers stored across cookies, local storage and synced storage to maintain cross-device tracking.
- A Huiyi translation extension monitored web requests and applied a remotely fetched proxy auto-configuration script, allowing traffic routing rules to change without an extension update.
- Unit 42 found AI-generated code fingerprints in multiple samples and recommends least-privilege extension policies, runtime behavioral analysis and treating browsers as a primary enterprise attack surface.
Article Details
- Attack Vectors
- Malicious Chrome extensions disguised as GenAI productivity tools abused broad browser permissions to read or modify page content, access cookies, and intercept network requests.
- Chrome MCP Server established persistent WebSocket C2 and executed JavaScript received from the remote server in the victim’s active tab.
- Supersonic AI collected email content from rendered page DOMs and sent it to an external server, including plaintext messages and OTPs.
- Reverse Recruiting read OpenAI, Gemini, and Claude API keys from chrome.storage.sync and forwarded them to a developer backend; it also transmitted users’ profile and resume data.
- Chat AI for Chrome changed the default search engine to route searches through chatgptforchrome[.]com and restored tracking identifiers from browser storage after deletion.
- The Huiyi translation extension fetched and applied a remote PAC script to route selected browser traffic through a proxy.
- Defensive Notes
- Install extensions only from trusted providers and apply least-privilege policies; scrutinize requested access to browser data and page content.
- Treat browser extensions as third-party software and the browser as an enterprise attack surface.
- Use runtime behavioral analysis, including monitoring network activity, cross-file information flows, and embedded domains.
- The article identifies complete uninstallation as the effective remediation for Chat AI for Chrome’s persistent search tracking.
- Palo Alto Networks says Advanced URL Filtering and Advanced DNS Security identify known malicious domains and URLs, while Prisma Browser monitors and controls browser add-ons.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | api[.]reverserecruiting[.]io | Backend domain receiving profile data and resumes from the Reverse Recruiting extension. |
| DOMAIN | chatgptforchrome[.]com | The Chat AI for Chrome extension routes user searches through this domain and correlates them with persistent tracking identifiers. |
| DOMAIN | gosupersonic[.]email | Domain listed as associated with Supersonic AI, whose content script exfiltrates email data to an external server. |
| DOMAIN | xuix[.]top | Domain contacted by the AI Photo and Video Editor extension’s thank-you page before redirecting users. |
| SHA256 | 0cbf101e96f6d5c4146812f07105f8b89bd76dd994f540470cd1c4bc37df37d5 | SHA-256 hash of the Chrome MCP Server extension package, identified as a RAT. |
| SHA256 | 4e38bee33237a8c8b17a2504013e506ca7cbf667a7f68a2d94d75db505c2149f | SHA-256 hash of the AI Photo and Video Editor extension package, which redirects users after installation. |
| SHA256 | 604c7aef72892b56ac23ad54744376574239c8f0651e95dd5b6cf540eb70f7c3 | SHA-256 hash of the Reverse Recruiting extension package, which steals API keys and user profile data. |
| SHA256 | ac0a312398b3bf6b3d7c5169687ca72f361838bc5a90f2c0dbce2dc8e2094a02 | SHA-256 hash of the Supersonic AI extension package, which exfiltrates email content. |
| SHA256 | c9754454efede2dec2fcb856faa40424b8df378706b664a5ae4847fcd0336b53 | SHA-256 hash of the Huiyi translation extension package, identified as spyware that applies a remotely fetched proxy configuration. |
| SHA256 | dfe307d957724ebe32331f92d53e366b7fa85968a9564c2285c5a0142ac9e1bb | SHA-256 hash of the Chat AI for Chrome extension package, identified as a search hijacker and tracking extension. |
| URL | hxxps[:]//yiban[.]io/extension/proxy.pac?t=huiyi | Remote PAC script fetched by the Huiyi extension and applied to route browser traffic through a proxy. |
MITRE ATT&CK
T1059.007 · JavaScriptChrome MCP Server used new Function() to execute JavaScript received from its remote server in the active tab.T1071 · Application Layer ProtocolChrome MCP Server used a persistent WebSocket connection to communicate with its remote C2 server.T1090 · ProxyThe Huiyi extension fetched a PAC script and applied proxy settings to route selected browser traffic.T1176 · Software ExtensionsThe reported malware was delivered as browser extensions that used injected content scripts and browser privileges.T1185 · Browser Session HijackingSupersonic AI read sensitive email content and OTPs from the rendered page DOM and sent the data externally.
Vendors
GoogleAI, Reverse Recruiting, Chat AI for Chrome, Huiyi translation extension), IOCs and mitigation guidance; Google removed or warned the extensions after disclosure.Palo Alto NetworksPalo Alto Networks reported the extensions to Google, which removed or warned owners; detection and mitigation recommendations include least-privilege extension policies, runtime behavioral analysis and treating
Products
Advanced DNS SecurityAdvanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious.Advanced URL FilteringAdvanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious.Advanced WildFireThe Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research.Chrome Web StoreThis GenAI-era adaptation disguises the RAT as an “AI browser automation tool” using the MCP framework, as shown in its Chrome Web Store listing in Figure 2.Gmail(RAT with wss://mcp-browser.qubecare[.]ai/chrome and remote new Function() execution), Supersonic AI (Gmail DOM exfiltration), Reverse Recruiting (API key theft), Chat AI for Chrome (search hijacking andGoogle Chromeproxy hijacking and spyware behaviors by abusing extension privileges (webRequest, debugger, , chrome.proxy, chrome.storage.sync) and embedding persistent WebSocket C2, API hooking and PAC-based proxies.OutlookSupersonic AI markets itself as an AI-powered email assistant for Gmail and Outlook.Prisma AIRSPrisma AIRS is designed to provide layered, real-time protection for AI systems by detecting and blocking threats, preventing data leakage and enforcing secure usage policies across a variety of AI applications.Prisma browserPrisma Browser users are better protected against malicious extension threats through integrated extension security that monitors and controls browser add-ons in real time.