Malicious ChatGPT Chrome extension hijacks Facebook accounts

The malicious use of ChatGPT, mentioned in ten of ten online advertisements, was only a matter of time. Earlier this month, cybersecurity firm Guardio Labs reported A fake version of OpenAI’s powerful tool disguised as a Google Chrome extension.

According to the Israeli lab, the app, which is a copy of the legitimate plugin “ChatGPT for Google”, has already been downloaded more than 9,000 times, with an additional code aimed at stealing cookies from Facebook logins.

According to the head of the security company, the publisher of the malicious extension uploaded it to the Chrome Web Store on February 14, but only began distributing it as a “trojan horse” through ads in Google Search a month later. From then on, the software started recording more than a thousand installations per day.

How does the fake ChatGPT extension work?

When the victim clicks on one of these sponsored surveys, taken to a fake “ChatGPT to Google” landing page and then to the official store extension page. After installing the plugin, the functionality is delivered as the legitimate extension code is available.

However, the malicious plugin also takes action by attempting to steal session cookies to be recognized on Facebook via the OnInstalled handler, an API available to Chrome extension developers.

After receiving cookies, threat actors decrypt them. and start targeting victims’ Facebook sessions for malicious advertising campaigns (online advertisements to distribute malware) or promote prohibited content such as shocking images of ISIS, the Islamic State of Iraq and the Levant.