Free VPN extensions read AI conversations and run hidden code

Researchers at Koi have described several browser extensions with hidden capabilities. Urban VPN Proxy, with more than six million installations and a Google "Featured" badge, received a July update that intercepts network traffic when the user visits selected AI platforms. Prompts, AI responses, conversation IDs, timestamps, session metadata and model details are packaged and sent to the vendor's servers. The feature is labelled "AI protection", is on by default and cannot be disabled. Similar functionality was found in seven further extensions. Koi also flagged the Firefox extension Free VPN Forever, whose logo file contains hidden JavaScript able to retrieve and execute payloads for affiliate link hijacking, security header stripping and hidden iframe injection. Sixteen other Firefox extensions share the same command-and-control infrastructure in what Koi calls the GhostPoster campaign.

What this means for your organisation

A browser extension runs inside the session where staff are already signed in. When AI conversations are siphoned off, what leaves the building is often the most sensitive material you hold: draft agreements, customer data, source code and internal assessments pasted into a chat window. That is processing of personal data and trade secrets nobody assessed or approved, taking place outside the view of both IT and the data protection officer.

Berigo recommends

• Enforce an allowlist for browser extensions so only approved ones can be installed on company machines.
• Inventory the extensions already installed and remove VPN and "free" extensions without a documented need.
• Bring AI tools into your record of processing activities, and tell staff clearly which platforms are approved for which data.
• Treat browser extensions as suppliers: they belong in the same assessment as any other software with access to your data.

Source

• koi.ai
• koi.ai