16 ChatGPT-themed Chrome and Edge extensions ("ChatGPT Mods") stole session tokens
Sixteen "ChatGPT Mods" browser extensions (15 Chrome, 1 Edge, ~900 installs) copied ChatGPT login tokens and sent them to the operator. If you installed any ChatGPT add-on from this publisher, remove it and sign out of ChatGPT everywhere.
Open your browser's extensions page, remove any ChatGPT add-on published by "ChatGPT Mods", then sign out of ChatGPT on all devices and change the password. Only install extensions you genuinely need.
What’s happening
LayerX researchers, now part of Akamai, reported on 26 January 2026 that 16 extensions sold as ChatGPT productivity tools were quietly harvesting login session tokens. Fifteen were on the Chrome Web Store and one on Microsoft Edge Add-ons, all tied to one operator and published under the name "ChatGPT Mods". Together they had roughly 900 installs. The extensions hooked the browser's network requests on ChatGPT pages, picked out the authorisation token and sent it to a server the operator controlled. A stolen token gives access equivalent to the victim's own session, including conversation history, and Akamai says connected services such as Google Drive, Slack and GitHub could be reachable. The flaw is not in ChatGPT itself. Akamai said all 16 were still listed when it wrote, and one carried a "featured" badge. Reports differ on whether the stores later removed them, and Malwarebytes notes that already-installed copies may stay active until removed by hand. Whether the stolen tokens were used against victims is not stated. The sources do not describe any later development.
- What
- Poisoned software
- Affects
- Chrome and Edge browser extensions for ChatGPT ("ChatGPT Mods")
- Affected
- 15 Chrome Web Store extensions and 1 Microsoft Edge Add-ons extension published as ChatGPT Mods
- Fixed in
- No fix yet
- Since
- 26 Jan 2026
- Closed
- 28 Jan 2026
Timeline
- Update
Malwarebytes said Microsoft and Google had been notified, and warned that copies already installed may keep running until users remove them by hand. Its report did not say whether the store listings had been taken down. Other coverage conflicts: SecurityWeek is reported as saying they were removed, while CyberInsider said they were still online.
- Made publicNo fix yet
Akamai (which has acquired LayerX) published LayerX research on 16 extensions, 15 on the Chrome Web Store and one on Edge Add-ons, that took ChatGPT session tokens and sent them to an operator's server. Combined installs were about 900, and all were still listed when the post was written.
Sources
- How we discovered a campaign of 16 malicious extensions targeting ChatGPTAkamai · 26 Jan 2026
- Malicious Chrome extensions can spy on your ChatGPT chatsMalwarebytes · 28 Jan 2026
- Chrome, Edge Extensions Caught Stealing ChatGPT SessionsSecurityWeek · 27 Jan 2026