Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

That AI Extension Helping You Write Emails? It’s Reading Them First

Summary: Unit 42 found 18 AI browser extensions marketed as productivity tools that instead delivered remote access Trojans, meddler-in-the-middle attacks and infostealers targeting prompts, user behavior and browser sessions. Palo Alto Networks reported the 18 high-risk extensions to Google, which either removed them or warned their owners to address policy violations, and multiple samples contained AI-generated code indicating threat actors used LLMs to speed malware production.

Bottom line: These extensions sit inside the browser's trusted process and can read decrypted HTTPS response bodies, so the proprietary code and strategic plans users paste into AI services are exactly what gets intercepted - far more valuable than the browsing metadata typical browser malware targets.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026