"AI Sidebar with DeepSeek, ChatGPT, Claude and more" reached over 300,000 installs and a 4.6-star rating in the Chrome Web Store while scraping ChatGPT and DeepSeek conversation content and sending it to external domains.
OX Security flagged it in December 2025. Google removed it in January 2026.
It came back in August 2026, and Netskope Threat Labs found what it does now.
The return was staged
| Version | When | What it did |
|---|---|---|
| 1.7.2.0 | 20–31 July 2026 | Clean. Nothing malicious. |
| 1.7.3.0 | August 2026 | A 21-line addition |
Eleven days of clean functionality is not an accident. It is update history — a record for a reviewer to look at, showing a well-behaved extension that has shipped a normal release. The payload arrives in the version after the one that established the pattern.
Netskope describes the malicious change as a surgical 21-line addition, which is the other half of the design. A small diff in an extension that already has a track record is close to the hardest thing for automated review to catch.
What it does now
Not conversation theft. Affiliate fraud:
- Opens affiliate links on update
- Overwrites the uninstall URL, exploiting a Chrome behaviour, so removing the extension also generates a referral
The second one is the interesting one. Chrome lets an extension set a URL to open when a user uninstalls it — intended for feedback forms. Here it is a last commission on the way out. There is no user action that does not pay the developer.
The listing is lying about who made it
The developer and data controller is listed as Extchange.com — a domain registered in February 2024 with no public registrant information.
The store listing names "DeepSeek AI" as the developer. It is not.
That is a plain misrepresentation sitting in a store listing that passed review twice, and it is the detail that makes the "how did this get back in" question uncomfortable. The extension did not sneak back under a new identity. It came back with a false developer name on the same product that was banned.
What this says about extension review
The pattern here is one we keep writing about in different registries — the npm dropper, poisoned BdThemes plugin data — but the browser case has a property the others do not.
An extension with sidebar access to your AI chats sits inside the session. It does not need credentials or a supply chain; it is already authenticated as you, on every page. When the payload was conversation theft, that meant everything you typed into ChatGPT — which for a lot of people includes code, customer data and internal documents.
The current payload is comparatively harmless. The access it retains is not.
What to do
- Check your extension list for this one and remove it. Then check what else has permission to read page content.
- Assume a banned extension can return. Removal from the store does not uninstall it from machines that already have it, and does not prevent a relisting.
- Treat "AI assistant" extensions as data processors. If an extension can see your ChatGPT window, it can see everything you put in it.
- In an enterprise, allowlist extensions rather than blocklisting them. A blocklist requires knowing the name in advance, and this one changed nothing about its name.
- Watch update diffs, not just installs. The dangerous version here was the one after the safe one.
