Re-Listed Chrome Extension Adds Affiliate Fraud to Its Update and Uninstall Flows

Summary

Netskope says a re-listed Chrome extension added affiliate redirects on updates and uninstalls in version 1.7.3.0. Earlier versions reportedly stole AI conversations; as of August 25, 2026, version 1.7.4 remained available with 200,000 users.

Key points

The “AI Sidebar with DeepSeek AI” extension was removed from the Chrome Web Store in January 2026 after earlier versions reportedly exfiltrated ChatGPT and DeepSeek conversations.
After relisting, the operator distributed a clean version 1.7.2.0 before inserting a 21-line monetization payload in version 1.7.3.0.
The payload silently opens an affiliate link on each extension update and uses a race condition to set the uninstall destination, generating another referral when users remove it.
The redirect resolves through bit[.]ly to an AI video service’s affiliate program; Netskope says it has no indication that the service knew about the abuse.
Netskope observed the extension delivered through Google’s CRX infrastructure and says it blocked the malicious version for its customers.
As of August 25, version 1.7.4 remained on the Chrome Web Store with 200,000 users; Netskope recommends removing extension ID inhcgfpbfdjbjogdfjbclgolkmhnooop and managing extensions through inventory and policy controls.

Article Details

Attack Vectors: A Chrome extension update delivered through Google’s CRX infrastructure inserted a monetization payload into version 1.7.3.0 after a clean predecessor release.
The extension silently opened an affiliate redirect on update and uninstall events; the operator wrote the uninstall URL twice to override the legitimate extension code’s setting.
Pre-1.7.x versions scraped ChatGPT and DeepSeek conversation content, base64-encoded it, and posted it to domains identified by the article as prior C2 infrastructure.
Defensive Notes: Inventory installed browser extensions and use default-deny installation policies with explicit exceptions.
Inspect extension packages inline, including packages delivered through vendor-owned CDNs.
Remove extension ID inhcgfpbfdjbjogdfjbclgolkmhnooop from managed browsers and verify it is absent from force-install and allowlist policies.
Treat removal of an extension from an official web store as a prompt for internal remediation, not as confirmation that the threat is resolved.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`chatsaigpt[.]com`	Identified as prior C2 for conversation exfiltration by pre-1.7.x versions; now offline.
DOMAIN	`deepaichats[.]com`	Identified as prior C2 for conversation exfiltration by pre-1.7.x versions; now offline.
SHA256	`15ca814190c84c662bee1276dd39b504ae86fc7ee5e86b13775b77672242dc25`	CRX hash for the extension that Netskope says it blocked.
SHA256	`2a57de8abd0d15e92784280e5d39906d69a2ae7bb9b2875c77c626e9f0794e05`	Malicious version 1.7.3.0 CRX hash.
URL	`hxxps[:]//bit[.]ly/3RPe03x`	Affiliate redirect opened silently on extension update and uninstall; the article says it can be retargeted.

MITRE ATT&CK

T1041 · Exfiltration Over C2 ChannelPre-1.7.x versions posted scraped, base64-encoded AI conversation content to domains identified as prior C2.T1176 · Software ExtensionsThe malicious functionality was delivered through a Chrome browser extension and its updates.

Vendors

GoogleSince publication, telemetry extending back to March 5, 2026 shows the extension has been continuously delivered via Google’s CRX infrastructure across seven versions.NetskopeNetskope has blocked it across our customers. CRX Hash: 15ca814190c84c662bee1276dd39b504ae86fc7ee5e86b13775b77672242dc25

Products

AI Sidebar with DeepSeek AIThe Chrome extension “AI Sidebar with DeepSeek AI” that Google removed from the Chrome Web Store in January 2026 for stealing AI conversation content resumed shipping code to enterprise endpoints in July 2026.BuzzyThe link resolves through Bitly to Buzzy, an AI video generation service that runs a public affiliate program paying 30% commission on referred subscriptions.Chrome Web StoreAs of August 25, the extension remains live on the Chrome Web Store at version 1.7.4 with 200,000 users.Google ChromeAs of August 25, the extension remains live on the Chrome Web Store at version 1.7.4 with 200,000 users.