Guardio researchers have discovered a malicious ChatGPT variant that can also steal Facebook session cookies and compromise accounts. It’s based on an open-source project of the same name, with the threat actor adding the extra malicious code. The extension is being distributed since at least March 14, 2023, using sponsored search results and also has been uploaded to the Chrome App Store.
The extension promised ChatGPT browser integration, copying a project called “ChatGPT for Google”. The fake extension was taken down a few hours after Guardio’s report to Google. It had amassed over 9,000 users at the time of removal.
The attackers were also using Google Ads to push sponsored search results promising access to GPT4. Once the user clicked on the malicious extension’s search result, it took them to the Chrome App Store waiting to be installed.
The fake variant was only doing one specific malicious action with the rest being nearly identical to the original so as to reduce any suspicions. Once the extension is installed, the OnInstalled function is triggered. The original uses this trigger to show users the options screen to log into their OpenAI account, while the malicious extension uses this to steal your session cookies.
There’s nothing too sophisticated about the theft either. The process is simple cookie hijacking dedicated to Facebook. A built-in function in the code filters Facebook-related cookies from the full list acquired by the Chrome Extension API while another one encrypts everything into AES using a hardcoded key “chatgpt4google”. Once the session list is complete, it’s sent to the Command and Control (C2) server hosted on worker.dev. The original ChatGPT extension was also using worker.dev to deploy code.
The attackers can then use these session lists to hijack your Facebook sessions eventually taking over your account. At this point, your account can be used for anything from a bot for commenting, liking and performing other promotional activities all while promoting services that aren’t strictly legal.
In the News: Ghostwriter will now assist Ubisoft scriptwriters with game scripts
