Google has removed a malicious version of the ChatGPT Chrome browser extension from its Web Store that was stealing Facebook session cookies to take over accounts. The trojanized version of the legitimate ChatGPT extension, called “ChatGPT for Google”, was originally uploaded to the Web Store on February 14, 2023, however the threat actor only started promoting it with Google Search advertisements on March 14, 2023. The extension had gained over 9,000 installations since March 14, 2023, and advertised the ability to improve search results when integrated. In actuality, the extension added code that covertly captured Facebook-related cookies and exfiltrated them to a remote server in an encrypted manner. The malware abuses the Chrome Extension API to acquire a list of the Facebook-related cookies before encrypting them using an AES key and attaching them to the X-Cached-Key HTTP header value. The stolen data is exfiltrated via a GET request to the attacker’s server which can then be decrypted, ultimately hijacking the victim’s Facebook sessions. Once the threat actor has the victim’s cookies, they can proceed to take control of their Facebook accounts, change the passwords, profile names, and pictures, and even use it to disseminate misinformation or extremist propaganda. The extension is communicating with the same infrastructure used in a previous Chrome add-on campaign that had amassed 4,000 installations before Google removed it from the Chrome Store earlier this month. The latest extension was a backup for when the earlier version was reported and removed. However, it’s likely that the threat actor will have a backup plan via another “parked” extension waiting to be published, facilitating the next wave of infections. This exploitation trend underscores how cybercriminals are adapting their campaigns to capitalize on the popularity of ChatGPT to distribute malware and stage opportunistic attacks.