Tuesday, August 11, 2026
LIVEThe Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///The Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///
Subscribe
Cyber Security
Independent · Digital
Thehackingpost
RSSSubscribe
CybersecurityAI-assisted

Popular Chrome Extension with Over 6 Million Installs Captures User Inputs to AI Chatbots

A Chrome extension with over 6 million users has been identified as collecting and selling user conversations from various AI platforms.

ABy Angela WatersDec 16, 20251 min read

A Chrome extension with over 6 million users has been identified as collecting and selling user conversations from various AI platforms.

Urban VPN Proxy, which has received Google's "Featured" badge, contains concealed code that intercepts and exfiltrates AI conversation data. While marketed as a privacy tool, it collects data from services like ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, DeepSeek, Grok, and Meta AI.

This discovery highlights the risks associated with browser extensions that can bypass standard security protocols. Users have unknowingly permitted the extension to monitor their interactions by installing it for VPN functionality. The data collection continues irrespective of the VPN's operational status.

The extension was featured on Google's marketplace with a high user rating, indicating a substantial breach of trust.

A Chrome extension with over 6 million users has been identified as collecting and selling user conversations from various AI platforms.
Angela Waters · Thehackingpost

The harmful code was introduced via a silent update in July 2025, specifically in version 5.5.0. Users who installed the extension prior to this update were not notified about the new data collection capability.

Information collected includes every prompt and response sent to AI services, along with conversation identifiers, timestamps, and session metadata. The data is transmitted to Urban VPN's servers for marketing analytics purposes through BiScience, a data broker.

The threat extends beyond Urban VPN Proxy, affecting seven additional extensions from the same publisher. These extensions, under different names like 1ClickVPN Proxy and Urban Ad Blocker, utilize the same data harvesting infrastructure, impacting over 8 million users across Chrome and Microsoft Edge.

Advertisement

The data collection involves a four-step process where the extension injects scripts onto AI platform pages, overriding browser APIs to intercept network requests and responses. This method captures raw API data, which is processed and sent to the extension's content script using the identifier PANELOS_MESSAGE. The data is then compressed and transmitted to external servers.

The extension's purported "AI protection" feature does not affect the data harvesting process, which operates independently and continues regardless of user settings.

Based on reporting by Cyber Security News.

AI transparency. This article was produced with the assistance of artificial intelligence and published under human editorial oversight. AI systems can make mistakes. Read how we use AI (EU AI Act, Art. 50).
Related Stories
Cybersecurity

Why Fintech Banking Platforms Are Reducing Operational Costs by 40%

Paige Monroe · Mar 26, 2026
Cybersecurity

Dogecoin Price Prediction: SHIB Burns 172M Tokens as Pepeto Exchange Earns From Every Trade

Eric Wallace · Mar 26, 2026
Cybersecurity

Solana Price Prediction: SOL Holds $86 With Commodity Status as Pepeto Targets Bigger Returns

Zachary Burns · Mar 26, 2026
Cybersecurity

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Joseph Cain · Mar 26, 2026