{
  "type": "URL",
  "indicator": "http://api.reverserecruiting.io/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "http://api.reverserecruiting.io/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4337020688,
      "indicator": "http://api.reverserecruiting.io/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "69f3e871eb2a73cd5c8bee7e",
          "name": "That AI Extension Helping You Write Emails? It's Reading Them First",
          "description": "Researchers discovered 18 malicious AI browser extensions masquerading as productivity tools that deliver remote access trojans, meddler-in-the-middle attacks, and infostealers. These extensions exploit the rise of generative AI to target prompts, user behavior, and browser sessions through API interception, passive DOM observation, traffic proxying, and HTTPS response decryption. Examples include extensions that surveil emails during composition, intercept ChatGPT prompts, and exfiltrate passwords. Multiple samples contained AI-generated code indicating threat actors employed large language models to accelerate production. Google removed or issued warnings for all 18 reported extensions. These malicious tools specifically target sensitive data including AI API keys, authentication credentials, email content, and proprietary session information by exploiting user trust in AI-branded applications.",
          "modified": "2026-05-04T14:03:53.246000",
          "created": "2026-04-30T23:40:33.081000",
          "tags": [
            "huiyi",
            "browser extension",
            "genai",
            "remote access trojan",
            "search hijacker"
          ],
          "references": [
            "https://unit42.paloaltonetworks.com/high-risk-gen-ai-browser-extensions/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Chrome MCP Server",
              "display_name": "Chrome MCP Server",
              "target": null
            },
            {
              "id": "Supersonic AI",
              "display_name": "Supersonic AI",
              "target": null
            },
            {
              "id": "Reverse Recruiting",
              "display_name": "Reverse Recruiting",
              "target": null
            },
            {
              "id": "Chat AI for Chrome",
              "display_name": "Chat AI for Chrome",
              "target": null
            },
            {
              "id": "AI Photo and Video Editor",
              "display_name": "AI Photo and Video Editor",
              "target": null
            },
            {
              "id": "Huiyi",
              "display_name": "Huiyi",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1036.005",
              "name": "Match Legitimate Name or Location",
              "display_name": "T1036.005 - Match Legitimate Name or Location"
            },
            {
              "id": "T1547.014",
              "name": "Active Setup",
              "display_name": "T1547.014 - Active Setup"
            },
            {
              "id": "T1204.002",
              "name": "Malicious File",
              "display_name": "T1204.002 - Malicious File"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1567",
              "name": "Exfiltration Over Web Service",
              "display_name": "T1567 - Exfiltration Over Web Service"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "AlienVault",
            "id": "2",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
            "is_subscribed": true,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "FileHash-SHA256": 6,
            "URL": 4,
            "domain": 7,
            "hostname": 3
          },
          "indicator_count": 21,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 386458,
          "modified_text": "26 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69fbad82234fc33123b0ce6d",
          "name": "EbeeMay2026 Pt1",
          "description": "Multiple APT/threat actors, Malware and Campaigns",
          "modified": "2026-05-06T21:07:14.769000",
          "created": "2026-05-06T21:07:14.769000",
          "tags": [
            "filehashsha256",
            "filehashmd5",
            "filehashsha1",
            "filepath",
            "localappdata",
            "cve20250994 cve",
            "temp",
            "mutex",
            "local"
          ],
          "references": [
            "IOCs-May1.csv"
          ],
          "public": 1,
          "adversary": "Trigona, PowerCod RAT, APT34, PhantomRaven, Hacked sites deliver infostealer, CloudZ RAT",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IMEBEEIMFINE",
            "id": "343873",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 80,
            "CIDR": 3,
            "CVE": 10,
            "FileHash-MD5": 154,
            "FileHash-SHA1": 140,
            "FileHash-SHA256": 219,
            "URL": 80,
            "domain": 82,
            "email": 8,
            "hostname": 60
          },
          "indicator_count": 836,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 39,
          "modified_text": "24 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69fab8eb2f39f70f6b775e45",
          "name": "IOC - That AI Extension Helping You Write Emails? It\u2019s Reading Them First",
          "description": "Leveraging the rise of generative AI (GenAI), these extensions deliver remote access Trojans (RATs), meddler-in-the-middle (MitM) attacks and infostealers that target prompts, user behavior and browser sessions. Attackers blend the following established techniques with AI productivity lures",
          "modified": "2026-05-06T03:43:39.583000",
          "created": "2026-05-06T03:43:39.583000",
          "tags": [
            "notion",
            "ai photo",
            "chrome mcp",
            "server",
            "ai browser",
            "control",
            "anker aime",
            "copilot",
            "nano banana",
            "text summarizer"
          ],
          "references": [
            "https://unit42.paloaltonetworks.com/high-risk-gen-ai-browser-extensions/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "celestre",
            "id": "295357",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 2,
            "URL": 3,
            "domain": 7,
            "hostname": 3
          },
          "indicator_count": 15,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "24 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69f97a779008486d3449e951",
          "name": "That AI Extension Helping You Write Emails? It's Reading Them First",
          "description": "",
          "modified": "2026-05-05T05:04:55.354000",
          "created": "2026-05-05T05:04:55.354000",
          "tags": [
            "huiyi",
            "browser extension",
            "genai",
            "remote access trojan",
            "search hijacker"
          ],
          "references": [
            "https://unit42.paloaltonetworks.com/high-risk-gen-ai-browser-extensions/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Chrome MCP Server",
              "display_name": "Chrome MCP Server",
              "target": null
            },
            {
              "id": "Supersonic AI",
              "display_name": "Supersonic AI",
              "target": null
            },
            {
              "id": "Reverse Recruiting",
              "display_name": "Reverse Recruiting",
              "target": null
            },
            {
              "id": "Chat AI for Chrome",
              "display_name": "Chat AI for Chrome",
              "target": null
            },
            {
              "id": "AI Photo and Video Editor",
              "display_name": "AI Photo and Video Editor",
              "target": null
            },
            {
              "id": "Huiyi",
              "display_name": "Huiyi",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1036.005",
              "name": "Match Legitimate Name or Location",
              "display_name": "T1036.005 - Match Legitimate Name or Location"
            },
            {
              "id": "T1547.014",
              "name": "Active Setup",
              "display_name": "T1547.014 - Active Setup"
            },
            {
              "id": "T1204.002",
              "name": "Malicious File",
              "display_name": "T1204.002 - Malicious File"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1567",
              "name": "Exfiltration Over Web Service",
              "display_name": "T1567 - Exfiltration Over Web Service"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "69f3e871eb2a73cd5c8bee7e",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Tr1sa111",
            "id": "192483",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "FileHash-SHA256": 6,
            "URL": 4,
            "domain": 7,
            "hostname": 3
          },
          "indicator_count": 21,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 276,
          "modified_text": "25 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "IOCs-May1.csv",
        "https://unit42.paloaltonetworks.com/high-risk-gen-ai-browser-extensions/"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [
            "Reverse recruiting",
            "Chrome mcp server",
            "Supersonic ai",
            "Huiyi",
            "Ai photo and video editor",
            "Chat ai for chrome"
          ],
          "industries": [],
          "unique_indicators": 21
        },
        "other": {
          "adversary": [
            "Trigona, PowerCod RAT, APT34, PhantomRaven, Hacked sites deliver infostealer, CloudZ RAT"
          ],
          "malware_families": [
            "Reverse recruiting",
            "Chrome mcp server",
            "Supersonic ai",
            "Huiyi",
            "Ai photo and video editor",
            "Chat ai for chrome"
          ],
          "industries": [],
          "unique_indicators": 840
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/reverserecruiting.io",
    "whois": "http://whois.domaintools.com/reverserecruiting.io",
    "domain": "reverserecruiting.io",
    "hostname": "api.reverserecruiting.io"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "69f3e871eb2a73cd5c8bee7e",
      "name": "That AI Extension Helping You Write Emails? It's Reading Them First",
      "description": "Researchers discovered 18 malicious AI browser extensions masquerading as productivity tools that deliver remote access trojans, meddler-in-the-middle attacks, and infostealers. These extensions exploit the rise of generative AI to target prompts, user behavior, and browser sessions through API interception, passive DOM observation, traffic proxying, and HTTPS response decryption. Examples include extensions that surveil emails during composition, intercept ChatGPT prompts, and exfiltrate passwords. Multiple samples contained AI-generated code indicating threat actors employed large language models to accelerate production. Google removed or issued warnings for all 18 reported extensions. These malicious tools specifically target sensitive data including AI API keys, authentication credentials, email content, and proprietary session information by exploiting user trust in AI-branded applications.",
      "modified": "2026-05-04T14:03:53.246000",
      "created": "2026-04-30T23:40:33.081000",
      "tags": [
        "huiyi",
        "browser extension",
        "genai",
        "remote access trojan",
        "search hijacker"
      ],
      "references": [
        "https://unit42.paloaltonetworks.com/high-risk-gen-ai-browser-extensions/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Chrome MCP Server",
          "display_name": "Chrome MCP Server",
          "target": null
        },
        {
          "id": "Supersonic AI",
          "display_name": "Supersonic AI",
          "target": null
        },
        {
          "id": "Reverse Recruiting",
          "display_name": "Reverse Recruiting",
          "target": null
        },
        {
          "id": "Chat AI for Chrome",
          "display_name": "Chat AI for Chrome",
          "target": null
        },
        {
          "id": "AI Photo and Video Editor",
          "display_name": "AI Photo and Video Editor",
          "target": null
        },
        {
          "id": "Huiyi",
          "display_name": "Huiyi",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1036.005",
          "name": "Match Legitimate Name or Location",
          "display_name": "T1036.005 - Match Legitimate Name or Location"
        },
        {
          "id": "T1547.014",
          "name": "Active Setup",
          "display_name": "T1547.014 - Active Setup"
        },
        {
          "id": "T1204.002",
          "name": "Malicious File",
          "display_name": "T1204.002 - Malicious File"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1567",
          "name": "Exfiltration Over Web Service",
          "display_name": "T1567 - Exfiltration Over Web Service"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "AlienVault",
        "id": "2",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
        "is_subscribed": true,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 1,
        "FileHash-SHA256": 6,
        "URL": 4,
        "domain": 7,
        "hostname": 3
      },
      "indicator_count": 21,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 386458,
      "modified_text": "26 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69fbad82234fc33123b0ce6d",
      "name": "EbeeMay2026 Pt1",
      "description": "Multiple APT/threat actors, Malware and Campaigns",
      "modified": "2026-05-06T21:07:14.769000",
      "created": "2026-05-06T21:07:14.769000",
      "tags": [
        "filehashsha256",
        "filehashmd5",
        "filehashsha1",
        "filepath",
        "localappdata",
        "cve20250994 cve",
        "temp",
        "mutex",
        "local"
      ],
      "references": [
        "IOCs-May1.csv"
      ],
      "public": 1,
      "adversary": "Trigona, PowerCod RAT, APT34, PhantomRaven, Hacked sites deliver infostealer, CloudZ RAT",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IMEBEEIMFINE",
        "id": "343873",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv4": 80,
        "CIDR": 3,
        "CVE": 10,
        "FileHash-MD5": 154,
        "FileHash-SHA1": 140,
        "FileHash-SHA256": 219,
        "URL": 80,
        "domain": 82,
        "email": 8,
        "hostname": 60
      },
      "indicator_count": 836,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 39,
      "modified_text": "24 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69fab8eb2f39f70f6b775e45",
      "name": "IOC - That AI Extension Helping You Write Emails? It\u2019s Reading Them First",
      "description": "Leveraging the rise of generative AI (GenAI), these extensions deliver remote access Trojans (RATs), meddler-in-the-middle (MitM) attacks and infostealers that target prompts, user behavior and browser sessions. Attackers blend the following established techniques with AI productivity lures",
      "modified": "2026-05-06T03:43:39.583000",
      "created": "2026-05-06T03:43:39.583000",
      "tags": [
        "notion",
        "ai photo",
        "chrome mcp",
        "server",
        "ai browser",
        "control",
        "anker aime",
        "copilot",
        "nano banana",
        "text summarizer"
      ],
      "references": [
        "https://unit42.paloaltonetworks.com/high-risk-gen-ai-browser-extensions/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "celestre",
        "id": "295357",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv4": 2,
        "URL": 3,
        "domain": 7,
        "hostname": 3
      },
      "indicator_count": 15,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "24 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69f97a779008486d3449e951",
      "name": "That AI Extension Helping You Write Emails? It's Reading Them First",
      "description": "",
      "modified": "2026-05-05T05:04:55.354000",
      "created": "2026-05-05T05:04:55.354000",
      "tags": [
        "huiyi",
        "browser extension",
        "genai",
        "remote access trojan",
        "search hijacker"
      ],
      "references": [
        "https://unit42.paloaltonetworks.com/high-risk-gen-ai-browser-extensions/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Chrome MCP Server",
          "display_name": "Chrome MCP Server",
          "target": null
        },
        {
          "id": "Supersonic AI",
          "display_name": "Supersonic AI",
          "target": null
        },
        {
          "id": "Reverse Recruiting",
          "display_name": "Reverse Recruiting",
          "target": null
        },
        {
          "id": "Chat AI for Chrome",
          "display_name": "Chat AI for Chrome",
          "target": null
        },
        {
          "id": "AI Photo and Video Editor",
          "display_name": "AI Photo and Video Editor",
          "target": null
        },
        {
          "id": "Huiyi",
          "display_name": "Huiyi",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1036.005",
          "name": "Match Legitimate Name or Location",
          "display_name": "T1036.005 - Match Legitimate Name or Location"
        },
        {
          "id": "T1547.014",
          "name": "Active Setup",
          "display_name": "T1547.014 - Active Setup"
        },
        {
          "id": "T1204.002",
          "name": "Malicious File",
          "display_name": "T1204.002 - Malicious File"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1567",
          "name": "Exfiltration Over Web Service",
          "display_name": "T1567 - Exfiltration Over Web Service"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "69f3e871eb2a73cd5c8bee7e",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Tr1sa111",
        "id": "192483",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 1,
        "FileHash-SHA256": 6,
        "URL": 4,
        "domain": 7,
        "hostname": 3
      },
      "indicator_count": 21,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 276,
      "modified_text": "25 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "http://api.reverserecruiting.io/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "http://api.reverserecruiting.io/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780180724.8441489
}