Analysis of Malicious Chrome Extension 'FakeGPT'

Incident Name: Malicious Chrome Extension (FakeGPT) Investigation

Date of Analysis: 2026-05-03

1. Executive Summary

The Security Operations Center (SOC) received alerts regarding suspicious network activity and reports of compromised accounts from multiple employees. Initial triage identified a common denominator: the installation of a browser extension masquerading as a legitimate “ChatGPT” tool.

A thorough reverse-engineering and static analysis of the extension’s source code confirmed it to be malicious. The extension functions as a credential harvester and keylogger, specifically targeting Facebook authentication data. It employs AES encryption and covert exfiltration techniques using HTML <img> tags to transmit stolen data to a remote command and control (C2) server. Furthermore, the malware utilizes anti-analysis checks to evade detection in sandbox or virtualized environments.

2. Artifact and Structure Analysis

Upon extraction, the extension exhibits a non-standard structure compared to typical legitimate extensions (which usually include icons/ or assets/ directories).

Figure 1: Extracted malicious extension directory structure.

For comparison, a legitimate extension structure typically contains properly organized resource folders:

Figure 2: Legitimate extension structure example.

The identified files of interest include:

• manifest.json: Defines high-risk permissions.
• app.js, loader.js, crypto.js: Core malicious JavaScript logic.
• ui.html: The deceptive user interface.

3. Technical Analysis

3.1. Permissions and Capability (manifest.json)

Review of the manifest.json revealed excessive and high-risk permissions granted to the extension:

Figure 3: manifest.json showing dangerous permissions.

Requested Permissions:

• "tabs", "http://*/", "https://*/": Grants the ability to interact with and read data from all web pages.
• "storage", "cookies": Allows reading and modifying sensitive session tokens and stored credentials.
• "webRequest", "webRequestBlocking": Enables the interception, monitoring, and modification of network traffic.

3.2. Evasion and Anti-Analysis (loader.js)

The loader.js file acts as the initial execution stage and incorporates environment checks to evade security analysis tools.

Figure 4: Anti-analysis logic in loader.js.

Mechanism:

1. Environment Check: It checks if navigator.plugins.length === 0 or if the browser string contains HeadlessChrome.
2. Evasion: If these conditions are met (indicating a likely sandbox or VM environment), execution halts.
3. Payload Execution: If the environment appears to be a real user system, it dynamically loads and executes the main payload (core/app.js).

3.3. Credential Harvesting and Keylogging (app.js)

The primary payload, app.js, contains the core data theft mechanisms.

Figure 5: Overview of app.js.

Figure 6: Credential harvesting logic.

Target Identification: A Base64 encoded string (d3d3LmZhY2Vib29rLmNvbQ==) decodes to www.facebook.com, indicating the primary target for credential theft.

Harvesting Methods:

1. Form Submission Interception: The script adds an event listener for the submit event. When a user logs in, it extracts the username/email and password fields from the form data.
2. Keylogging: As a fallback mechanism, it implements a keydown event listener to log individual keystrokes, ensuring credentials can be reconstructed even if standard form submission fails or is bypassed.

Figure 7: Fallback keylogger implementation.

3.4. Data Encryption and Packaging (app.js)

Before transmission, stolen data is structured and encrypted to avoid detection by network monitoring tools (e.g., DLP, IDS/IPS).

Figure 8: Payload packaging and encryption flow.

Figure 9: AES encryption mechanism.

Encryption Flow:

1. Packaging: Extracted credentials and target site information are bundled into a JSON object.
2. Encryption: The object is encrypted using AES. A unique Initialization Vector (IV) is generated and used as a salt.
3. Encoding: The IV and the resulting ciphertext are concatenated and encoded in Base64 format to ensure safe transmission via HTTP GET parameters.

3.5. Covert Exfiltration (app.js)

The exfiltration mechanism is designed to be highly stealthy, bypassing standard Cross-Origin Resource Sharing (CORS) restrictions.

Figure 10: Exfiltration via HTML Image Tag.

Exfiltration Flow:

1. The encrypted, Base64-encoded payload is URL-encoded.
2. The script dynamically creates a hidden HTML Image object (new Image()).
3. The payload is appended as a query parameter (?data=...) to the C2 domain URL.
4. By assigning this URL to the img.src attribute, the browser automatically initiates an HTTP GET request to the C2 server. This traffic blends in as a standard image fetch request, making it difficult to spot anomalies without deep packet inspection.

4. Indicators of Compromise (IoCs)

Type	Indicator	Description
Domain (C2)	Mo.Elshaheedy.com	Destination server for exfiltrated credentials.
URL Path	https://Mo.Elshaheedy.com/collect?data=	Endpoint receiving the encrypted payload.
Target Domain	www.facebook.com	Primary target defined in the code (Base64: d3d3LmZhY2Vib29rLmNvbQ==).
File	app.js, loader.js, crypto.js	Core malicious components of the extension.

5. Conclusion and Recommendations

The “FakeGPT” extension is a sophisticated credential harvester disguised as a productivity tool. It utilizes anti-analysis techniques, robust encryption (AES), and stealthy exfiltration channels (<img> tags) to steal Facebook credentials.

Mitigation Actions:

1. Immediate Remediation: Forcibly remove the malicious extension from all affected endpoints.
2. Credential Reset: Mandate an immediate password reset for all potentially compromised accounts, specifically Facebook, but extending to enterprise SSO if passwords are reused.
3. Network Blocking: Implement blocks at the firewall and web proxy for the C2 domain (Mo.Elshaheedy.com).
4. Endpoint Monitoring: Update EDR/AV signatures to detect the structural anomalies and specific JavaScript behaviors identified in this analysis.
5. Policy Update: Restrict the installation of browser extensions across the organization to an approved allowlist to prevent similar incidents in the future.