Overview of the Emerging Threat
Recent investigations by security teams at Socket, Symantec, LayerX and others have revealed a coordinated campaign of malicious browser extensions. These add‑ons masquerade as ad blockers, coupon finders or AI utilities while performing hidden actions such as affiliate‑link replacement, data exfiltration, and theft of OpenAI ChatGPT authentication tokens.
Affiliate‑Link Hijacking Extensions
One of the most prominent examples is the \"Amazon Ads Blocker\" (ID pnpchphmplpdimbllknjoiopmfphellj) published by \"10Xprofit\" on 19 January 2026. Although it blocks sponsored content, the extension silently scans every Amazon product URL, removes existing affiliate tags and injects the attacker’s tag 10xprofit-20. The same technique is used on other platforms (AliExpress, Best Buy, Shein, Shopify, Walmart) with different tags.
- 29 extensions across multiple e‑commerce sites.
- Automatic tag replacement or appending without user interaction.
- Exfiltration of scraped product data to
app.10xprofit.io.
Impact on Content Creators and Users
Creators who earn commissions through their own affiliate links lose revenue because the malicious extensions overwrite their tags. Users are misled by \"false consent\" disclosures that claim a simple coupon‑deal tool while the real function is covert affiliate injection. This violates Chrome Web Store policies that require clear disclosure, user‑initiated actions, and single‑purpose extensions.
ChatGPT Authentication Token Theft
A separate cluster of 16 extensions (15 on Chrome, 1 on Edge) injects a content script into chatgpt.com to capture authentication tokens. The extensions have been downloaded roughly 900 times. Stolen tokens give attackers full account‑level access to conversation history, metadata and the ability to impersonate the user.
Malware‑as‑a‑Service: The \"Stanley\" Toolkit
Researchers identified a new Russian‑origin toolkit named \"Stanley\" sold for $2 000–$6 000. It automates the creation of malicious Chrome extensions that:
- Serve phishing pages inside an HTML iframe while keeping the legitimate URL in the address bar.
- Provide a C2 panel for managing redirects and fake browser notifications.
- Offer a \"guaranteed\" pass through Google’s vetting process for a premium price.
Typical payloads appear as harmless note‑taking utilities but activate full‑screen phishing overlays on targeted sites such as banking portals.
Recommendations for Organizations and End‑Users
- Audit installed extensions regularly and remove any that are not essential.
- Enforce a whitelist‑only policy for browser extensions in corporate environments.
- Monitor network traffic for outbound connections to suspicious domains like
app.10xprofit.io. - Educate users about the risks of extensions that combine unrelated functions (ad‑blocking + affiliate injection).
- Implement multi‑factor authentication for OpenAI accounts to mitigate token theft.
Conclusion
The campaign demonstrates how attackers weaponize the trust placed in popular browser extensions and AI‑related tools. By blending legitimate‑looking features with covert data‑stealing behavior, these extensions create a new, high‑risk attack surface that demands vigilant monitoring, strict extension governance, and user education.