🚨 Security Disclosure / Verification 🚨 Following Koi Team’s recent disclosure, SlowMist has verified that the Urban VPN Proxy Chrome extension (~6M users) exhibits over-privileged behavior, collecting users’ conversations across major AI platforms 🤖⚠️ Our verification confirms that the extension: 🔍 executors/chatgpt.js hooks the fetch API to collect ChatGPT conversations (user inputs and AI responses), then forwards the data via postMessage("CHATGPT_DATA") → ad-blocker/content.js → sendMessage → ad-blocker/background.js, where rawTicket.aiSessions is constructed and ultimately transmitted to https://analytics-toolbar.urban-vpn[.]com/tickets 🌐 🛡️ Security Reminder Browser extensions — especially VPNs, ad blockers, and so-called “security” tools — often have broad privileges and auto-update silently. Users and organizations should regularly audit installed extensions and avoid sharing sensitive information in AI tools when untrusted extensions are present. 📚 More on malicious extensions: https://slowmist.medium.com/unraveling-how-a-malicious-extension-stole-a-million-dollars-e847a83cc50e 📄 Original disclosure by Koi Team: https://www.koi.ai/blog/urban-vpn-browser-extension-ai-conversations-data-collection Stay safe! 🧠🧐(SlowMist)