Chrome Extension Banned for AI Chat Theft Returns with Affiliate Scheme

Re-emergence of a Malicious Extension

A Chrome extension, previously identified for stealing AI chat data, has been detected back on the Chrome Web Store. The extension, named 'AI Sidebar with DeepSeek, ChatGPT, Claude and more,' was initially removed by Google in January 2026 following allegations of conversation theft. It had accumulated over 300,000 installs before its removal.

Shift to Affiliate Monetization

Upon its return in August 2026, the extension no longer exhibits the original data scraping behavior. Instead, Netskope Threat Labs reports that version 1.7.3.0, distributed in late July 2026, includes a new monetization scheme. This scheme activates affiliate links when the extension updates or is uninstalled, generating commissions for the operators.

Technical Details of the Scheme

The monetization is implemented through a 21-line code addition. When Chrome reports an extension update, a service worker opens an affiliate link in a new foreground tab, routing through a URL shortener to an AI video-generation platform. For uninstalls, the extension exploits a Chrome quirk by overwriting the legitimate uninstall URL five seconds after loading, ensuring a referral is generated even when users remove it.

Attribution and Detection

Attribution for the extension points to a company named Extchange.com, listed as both developer and data controller within the extension's files. The Chrome Web Store listing falsely identifies the developer as DeepSeek AI. Netskope detected and blocked version 1.7.3.0, classifying it as Trojan.GenericFCA.Script.37952, and has reported the extension to the Chrome Web Store.