cyber.hendryadrian.com
Security News · securityonline.info

Researchers Say “ChatGPT Ad Blocker” Extension Harvested Conversations

· Original article ↗

Summary

A DomainTools investigation reported that a malicious Chrome extension copied ChatGPT conversation pages and sent prompts and metadata to a private Discord channel. The developer’s links to other AI services raise concerns, but do not establish those services also stole

Key points

  • The “ChatGPT Ad Blocker” Chrome extension was presented as an ad-blocking utility but reportedly harvested ChatGPT conversation data.
  • The extension cloned the ChatGPT page DOM, removing some rendering elements while preserving conversation text and structure.
  • It reportedly redacted only text nodes longer than 150 characters, leaving most prompts and responses intact.
  • Captured prompts, metadata, and UI state were bundled into a page dump and sent to a private Discord channel through a hardcoded webhook.
  • A bot named “Captain Hook” reportedly received the data.
  • The extension was linked to the GitHub ID krittinkalra, also associated with AI4ChatCo and Writecream; the article raises concerns about those services but provides no evidence that they also stole user data.

Article Details

Event Type
Malicious Chrome extension harvesting ChatGPT conversations
Impact
The extension reportedly copied ChatGPT page content, including prompts, AI responses, metadata, and UI state, and sent it to a private Discord channel through a hardcoded webhook. This could expose users’ personal information and intellectual property. The article does not confirm theft from Writecream or AI4ChatCo; it raises that as a concern.

MITRE ATT&CK

T1567.004 · Exfiltration Over WebhookThe extension reportedly exfiltrated captured conversation data through a hardcoded webhook to a private Discord channel.

Vendors

OpenAIAs OpenAI shifts toward serving advertisements to users on its free tier, a new wave of opportunistic threats is emerging.

Products

AI4ChatCoThe extension is linked to GitHub ID krittinkalra and services like AI4ChatCo and Writecream, prompting concerns about broader data theft across related AI apps.ChatGPTSecurity researchers discovered a malicious Chrome extension called “ChatGPT Ad Blocker” that posed as an ad-blocking utility while systematically harvesting full ChatGPT conversation pages.ChatGPT Ad BlockerSecurity researchers discovered a malicious Chrome extension called “ChatGPT Ad Blocker” that posed as an ad-blocking utility while systematically harvesting full ChatGPT conversation pages.Discordmost text content, bundles prompts and metadata into a page dump, and exfiltrates it to a private Discord channel via a hardcoded webhook, raising concerns linked to the GitHub persona krittinkalra andWritecream#ChatGPTAdBlocker #Writecream

Tools

Captain HookCaptured data (full prompts, metadata, UI state) is sent to a private Discord channel via a hardcoded webhook and processed by a bot called “Captain Hook.”

Related Articles