A Stealer pushed with Google’s Sponsored Search As an open-source project, it is meant to share knowledge and contribute to the developers’ community - little did they know it will be abused so easily for malicious activity. The genuine “ChatGPT For Google” extension is based on this Open-Source project, which gained popularity and millions of users in the past few months. Right: The genuine “ChatGPT for Google” extension Left: The “FakeGPT” Variant on Chrome Store. From zero to “hero” in probably less than 2 minutes. This time, threat actors didn’t have to work hard on the look and feel of this malicious ChatGPT-themed extension - they just forked and edited a well-known open-source project that does exactly that. The new variant of the FakeGPT Chrome extension, titled “Chat GPT For Google”, is once again targeting your Facebook accounts under a cover of a ChatGPT integration for your Browser. At the time of removal, it was stated 9000+ users installed it. Update: MaFew hours after Guardio’s report to Google, the extension is now removed from the Chrome store. In this write-up we will share our insights on this latest variant activities, how it abuses open-source as well as the effective propagation using Google services. This follows the current trend of hijacked Facebook accounts turning into “Lily Collins” clones and bots used to promote malicious activities all around from buying likes to straight forward ISIS propagandas. Propagating since using malicious sponsored Google search results and deployed on the official Chrome Store - it is stealing Facebook session cookies and compromising accounts in masses. This time, it is based on an open-source product stuffed with malicious code, making the product function as expected and impossible to distinguish. “FakeGPT” #2: Open-Source Turned Malicious in Another Variant of the Facebook Account-Stealer Chrome Extensionįollowing our discovery of “ FakeGPT”, the Facebook Ad Accounts stealer masquerading as a Chat-GPT Chrome Extension, Guardio’s security team uncovered another variant in a new campaign already hitting thousands a day.

Download chrome