A Chrome extension previously banned for data theft has resurfaced, raising significant cybersecurity concerns. Initially removed in January 2026 due to allegations of scraping AI chat content, the extension, known as 'AI Sidebar with DeepSeek, ChatGPT, Claude and more,' is back on the Chrome Web Store. Netskope Threat Labs reports that this extension, which once garnered over 300,000 installs, is once again targeting enterprise browsers through Google's CRX distribution. While earlier versions had ceased malicious activity, the latest update, version 1.7.3.0, introduces a new monetization tactic. This version exploits update and uninstall events to trigger affiliate links, potentially suggesting future malicious payloads could be delivered using the same method. The operation is linked to Extchange.com, and Netskope has classified this update as a security threat, recommending immediate removal. The security firm emphasizes the threat of future, more harmful payloads being delivered through this channel.
Chrome Extension Returns with Malicious Intent After Removal
A Chrome extension removed for stealing AI chats returned to the Web Store and resumed malicious activities — immediate remediation recommended.
Executive Summary
A Chrome extension previously banned for data theft is back on the Chrome Web Store, again engaging in harmful activities. Netskope warns that while current threats are low-stakes, the same method could deliver more damaging payloads in the future.