These ‘Ad Blocker’ Extensions Quietly Steal ChatGPT Logins, Amazon Affiliate Earnings

Cybersecurity researchers have discovered several malicious Google Chrome extensions that hijack Amazon affiliate links, steal data, and collect ChatGPT authentication tokens.

In late January, Socket researcher Kush Pandya found that a Chrome Web Store extension called Amazon Ads Blocker (extension ID: pnpchphmplpdimbllknjoiopmfphellj) does block ads, but also hides its primary function: automatically injecting the developer's affiliate tag (10xprofit-20) into every Amazon product link and replacing existing affiliate codes. Content creators who share Amazon product links with their own affiliate tags lose commissions when users with installed add-ons click those links.

Pandya's team identified that Amazon Ads Blocker belongs to a coordinated cluster of 29 browser extensions targeting e-commerce platforms like AliExpress, Amazon, Best Buy, Shein, Shopify, and Walmart. Extensions scan all product URLs for affiliate tags without requiring user interaction and replace them with the attacker's code. When there are no tags, the extensions simply add the ...