Multiple independent research teams have documented an active campaign wave in which malicious Chrome extensions disguised as AI productivity tools, fake ChatGPT, Copilot, and similar assistants, harvest credentials, steal authenticated session tokens, and exfiltrate email from Gmail and Microsoft Outlook. At least one campaign variant reached 260,000 installs before removal. Because these extensions execute inside the browser’s trusted context, perimeter and network controls provide no protection; the attack surface exists on every managed and unmanaged endpoint where employees install browser extensions.