# Unit 42 — 18 High-Risk GenAI Chrome Extensions Deliver RATs, AitB, Infostealers, and Search Hijackers Targeting AI Users

> Unit 42 (Palo Alto Networks) disclosed 18 malicious Chrome extensions disguised as GenAI productivity tools — email assistants, ChatGPT/Notion helpers, AI translators, and Model Context Protocol (MCP) browser-control agents — with a combined ~73,400+ installs. The extensions deliver Remote Access Trojans, Adversary-in-the-Browser (AitB) email exfiltration, infostealers targeting OpenAI/Gemini/Claude API keys, search hijackers, and brand-impersonator adware. Multiple samples bear LLM-generated code fingerprints, and Google removed or warned the listed extensions following Unit 42's disclosure on 2026-04-30.

- **Published:** 2026-05-02T12:00:00Z
- **Last reviewed:** 2026-05-02T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0448
- **ID:** TL-2026-0448
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 53 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-04-30, Unit 42 published research identifying 18 high-risk Chrome Web Store extensions that weaponize the GenAI productivity narrative to gain over-broad host permissions (<all_urls>, chrome.debugger, chrome.webRequest, chrome.proxy, chrome.cookies, chrome.storage.sync) and then deliver six distinct malware classes against users of AI tools. The campaign exploits user trust in AI assistants — translators, email writers, ChatGPT companions, Notion sidekicks, MCP browser controllers — to install browser-resident implants that operate inside the TLS boundary and below network-monitoring controls.

The flagship Remote Access Trojan, "Chrome MCP Server — AI Browser Control" (extension ID fpeabamapgecnidibdmjoepaiehokgda, SHA256 0cbf101e96f6d5c4146812f07105f8b89bd76dd994f540470cd1c4bc37df37d5), masquerades as a local Model Context Protocol bridge and advertises "100% local processing" and "no external servers required" while opening a persistent WebSocket to wss://mcp-browser.qubecare[.]ai/chrome. The implant exposes more than 30 remote commands executable through new Function() and attaches the Chrome Debugger Protocol to decrypt HTTPS traffic in-process — a full RAT with screen, navigation, DOM, network and storage primitives. Two additional extensions (AI Agent, Ask AI - GPT chat) follow the same WebSocket-RAT pattern with infrastructure at 199.80.55[.]27:3130 and adjacent domains.

The Adversary-in-the-Browser cluster is anchored by "Supersonic AI" (ID eebihieclccoidddmjcencomodomdoei, ~30,000 installs, SHA256 ac0a312398b3bf6b3d7c5169687ca72f361838bc5a90f2c0dbce2dc8e2094a02) at gosupersonic[.]email. Content scripts harvest Gmail/Outlook message bodies, headers, and one-time passcodes directly from the rendered DOM, exfiltrating plaintext credentials and OTP codes without ever issuing observable network requests against the mail provider — bypassing CASB, DLP, and SWG controls that operate at the network layer.

The infostealer cluster targets the new high-value asset class of LLM API keys. "Reverse Recruiting — AI Job Application Assistant" (iefpkdilnfhogjbkhgnliaomoldgkdlj) reads chrome.storage.sync for OpenAI, Gemini, and Claude API keys and ships them in custom HTTP headers to api.reverserecruiting[.]io/v1/profile/sync along with full job-applicant PII (resume, salary expectations, LinkedIn). "Anker AIME Copilot," "Nano Banana," and the "Notion中文版" cluster (three near-identical Notion impersonators) round out this category, exfiltrating prompt history, session tokens, and identity material to banana.summarizer[.]one, notionapp[.]cn, and 172.16.18[.]184:5443.

The search-hijacker "Chat AI for Chrome" (jhhjbaicgmecddbaobeobkikgmfffaeg, SHA256 dfe307d957724ebe32331f92d53e366b7fa85968a9564c2285c5a0142ac9e1bb) registers chrome_settings_overrides to redirect default-search to chatgptforchrome[.]com and uses a triple-storage persistence pattern (chrome.cookies + window.localStorage + chrome.storage.sync) with chrome.cookies.onChanged listeners that resurrect any deleted tracking cookie from synced storage — propagating the hijack to every signed-in Chrome instance.

The spyware exemplar, "会译:一站式 AI 翻译 Agent" (dgeiaiglmhdhajbpfbmajaajdlfdinpi, ~20,000 installs, SHA256 c9754454efede2dec2fcb856faa40424b8df378706b664a5ae4847fcd0336b53), abuses chrome.proxy with a remotely-hosted PAC script at yiban[.]io/extension/proxy.pac and a command channel at huiyiai[.]net. Because the PAC file is fetched dynamically, operators can selectively re-route arbitrary subsets of victim traffic through attacker-controlled proxies without ever updating the extension package.

Finally, the brand-impersonator cluster ("Picsart: AI Photo Video Editor," "[Redacted]: AI Photo, Video," "Agent Risk Reminder Remover") leverages chrome.runtime.onInstalled to force-open thank-you pages on first run, redirecting through xuix[.]top to newextensioninstallweb[.]com/2025 and pic-editor-chromeextension[.]uno for affiliate-fraud monetization. Six extensions in this cluster are linked under what Unit 42 calls the "10xprofit affiliate hijacking campaign" and exhibit AI-generated code fingerprints — formulaic divider comments, identical scaffolding, and template-based structure suggesting LLM-assisted mass production of malicious code.

Unit 42 reported all 18 extensions to Google, which either removed them from the Chrome Web Store or issued policy-violation warnings to their owners. The campaign is significant for three reasons: (1) it operationalizes browser extensions as the modern equivalent of supply-chain implants for AI workflows; (2) it demonstrates that LLM-generated malware is now a measurable production technique; and (3) it targets the credential class — OpenAI/Gemini/Claude API keys — that grants pivot access to enterprise AI infrastructure beyond the compromised browser.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1189 Drive-by Compromise
- T1176 Software Extensions
- T1547 Boot or Logon Autostart Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1036 Masquerading
- T1564 Hide Artifacts
- T1685 Disable or Modify Tools
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1555 Credentials from Password Stores
- T1111 Multi-Factor Authentication Interception
- T1217 Browser Information Discovery
- T1082 System Information Discovery
- T1557 Adversary-in-the-Middle
- T1185 Browser Session Hijacking
- T1114 Email Collection
- T1056 Input Capture
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1102 Web Service
- T1090 Proxy
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [That AI Extension Helping You Write Emails? It's Reading Them First](https://unit42.paloaltonetworks.com/high-risk-gen-ai-browser-extensions/)
- [Unit 42 prior research: Gemini Live in Chrome hijacking](https://unit42.paloaltonetworks.com/gemini-live-in-chrome-hijacking/)
- [The Hacker News — Chrome Extension Turns Malicious After Ownership Transfer](https://thehackernews.com/2026/03/chrome-extension-turns-malicious-after.html)
- [Infosecurity Magazine — Chrome Extension Uses AI Engine to Act Without User Input](https://www.infosecurity-magazine.com/news/chrome-extension-ai-engine-act-mcp/)
- [Chrome Web Store policy — Limited Use of User Data](https://developer.chrome.com/docs/webstore/program-policies/limited-use)
- [Chrome Enterprise — ExtensionInstallBlocklist policy](https://chromeenterprise.google/policies/#ExtensionInstallBlocklist)
- [MITRE ATT&CK T1176.002 — Browser Extensions](https://attack.mitre.org/techniques/T1176/002/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0448