Akamai acquired LayerX. This previously published blog post reflects the product and feature names on the original date of publication.

\r\n Contributors: Dar Kahllon

\r\n As generative AI tools like ChatGPT, Claude, Gemini, and Grok become part of everyday workflows, attackers are increasingly exploiting their popularity to distribute malicious browser extensions.

\r\n In this research, we uncovered a coordinated campaign of Chrome extensions posing as AI assistants for summarization, chat, writing, and Gmail assistance. While these tools appear legitimate on the surface, they hide a dangerous architecture: instead of implementing core functionality locally, they embed remote, server-controlled interfaces inside extension-controlled surfaces and act as privileged proxies, granting remote infrastructure access to sensitive browser capabilities.

\r\n Across 30 different Chrome extensions, published under different names and extension IDs and affecting over 260,000 users, we observed the same underlying…