Fake ChatGPT extension steals Facebook cookies

Fraudsters also knew how to take advantage of the popularity of ChatGPT. An extension was circulating in the Chrome Store that used the same functions and a similar name, but had one primary goal: steal Facebook cookies.

The fake add-on called Chat GPT for Google had been in circulation since February 2023 and has now been removed from the store. However, by then more than 9,000 users had already installed the account-compromising bot.

The problem: The Chat GPT add-on not only had a space, but also a few more lines of code than the original. Thus, the fake extension was based on the same open source project, but with the addition of precarious lines of code that gave the order to steal cookies.

“The result is an extension that looks and works the same as ChatGPT from the user’s perspective,” said security researchers at Guardio Labswho discovered the FakeGPT. Because this FakeGPT variant performed only one specific malicious action right after installation, “there was no reason to suspect.”

Like the security researchers in the blog post explain, the possibilities for scammers to use stolen Facebook data are almost unlimited. “You can use the profile as a bot for commenting, liking, promoting, creating pages or advertising accounts using both your reputation and your identity.”

Facebook sessions could be quickly taken over and basic login credentials changed. “From that point on, you lose control of your profile without being able to regain it.”

If the fraudsters do not use the data directly themselves, there is of course the possibility of selling it to third parties.

Guardio Labs experts are certain: as the popularity of ChatGPT increases, so will the abuse of the brand. Security service provider Bitdefender Labs recently warned of a new phishing campaign using a counterfeit ChatGPT platform to steal money and user data.

“Big services provided by Facebook, Google and other big corporations are under constant attack,” the Guardio Labs blog post reads.

In order to overcome security gaps that “affect users en masse”, one thing is needed above all: the awareness that they exist.