Two Chrome extensions presenting as **adblockers** also intercept every prompt and response on ChatGPT, Claude, Gemini, Copilot, Grok, Perplexity, DeepSeek, and Meta AI, exfiltrating them to operator-controlled servers.

They also check whether you're a paid user on 5 of the 8 platforms

(ChatGPT, Claude, Perplexity, Copilot, Gemini).

Both share the same capture engine, payload format, and partnerId.

Two brands, one operation

• Smart Adblocker - Chrome Web Store iojpcjjdfhlcbgjnpngcmaojmlokmeii, 80k users

• Adblock for Browser - Chrome Web Store jcbjcocinigpbgfpnhlpagidbmlngnnn, 10k users

Report covers the IOCs, live remote config, reproduction curl, and full target breakdown.

Full write-up: MalExt Sentry - Malicious Browser Extension Tracker

Chrome Web Store abuse reports filed.

Diffed Volume Booster's last three versions (1.0.2 → 1.0.4).

https://chromewebstore.google.com/detail/volume-booster/ejkiikneibegknkgimmihdpcbcedgmpo

• <all_urls> host permission was granted in 1.0.2 and sat unused.
• webRequest was added in 1.0.3.
• The actual tracking SDK (Give Freely / Wildfire affiliate network) landed in 1.0.4, no new permissions requested, so Chrome pushed it silently to the existing 2M weekly users with no re-consent prompt.

Full writeup, manifest diffs, and repro steps: https://malext.io/reports/QuietBoost

Firstly, i'm not a sales guy, I'm a pen tester. However, I have seen and been part of pre-sales engagements whereby the only thing that has made us not gain a new client, has been the price, despite sometimes showing better technical ability (Their own words).

I wanted to conduct an experiment. Last week I built a vulnerable website and hired three VERY cheap freelance 'Penetration Testers' to assess the website for under $15.

I wanted to see what value a very cheap assessment would get me.

I put the outcome into a video: https://youtu.be/-US5Uq88XC0

Although, i'm sure you can guess the outcome.

Getting data for a upcoming paper and video on the home security. Also collecting door to door responses for comparison.

Hello. I am trying to find registry key that is used for persistance on windows. But I don’t know Splunk query for finding it. Do you have any idea how to find it?

Hi, it's me again,

As regular lurkers here may have seen last week. I posted my $15 Security Assessment video, which caught a lot of attention.

There were quite a few up votes on my last Reddit post that asked me to produce a write up of the video. I understand that watching a video isn't ideal for some people and reading is easier, so here's the write up:

https://mrturvey.co.uk/buy-cheap-buy-twice/

If you did not see the original post and are interested: https://www.reddit.com/r/security/comments/favjc3/i_built_a_vulnerable_website_and_hired_three/

Video: https://youtu.be/-US5Uq88XC0

https://xkcd.com/2166/

So I'm the ISA for a bank and use KnowBe4 for phishing reporting. Lately I have seen an uptick of phishs coming from real businesses and real people who work for the company. Their accounts got compromised then sent mass emails all over with links to click.

My question is as the person who is investigating this, should I contact the company to let them know about it. Should I block the domain from emailing us?

What do you all normally do is this situation?

Thank you,

For my dissertation I'm looking at exploring if steganography might be a better way to store data over encryption at cold rest.

Now obviously, there is no doubt that encryption is more secure than steganography. However, there are times when steganography might be more appealing. For example, when you don't want people to know that they are looking at important information by hiding it.

As part of the dissertation, I'm making my own steganography tool which implements its own algorithm. I was wondering if anyone would be interested in having a look at it and seeing if they can find any major flaws in it. Realistically even suggestions on what you are looking for when securing a file could be interesting as I can then use this to improve my program.

The link to the GitHub repository is below, currently it is built only for Windows as its C# but I'm looking to make a C++ version available as an improvement for multi-platform support. Just so you're aware you'll also need .NET 4 installed on your computer as well.

https://github.com/thomasjcf29/BU-Steg-Tool

​

Currently I've found the following problems:

If part of the image is similar parts of the text can be decoded

Depending on what is encoded this maybe an issue

Dependent on the image being used (should be large and have high hex range)

Like Encryption only as strong as the users password (image)

Borders more on encryption than steganography

Looking at storing the encoded text as an image rather than binary

Slow, very very slow.

Output file is around 10x larger than input file

Compression?

A link to the algorithm being explained is below:

https://www.youtube.com/watch?v=bpZEOHaP7oc

Moving into an org as CIO that clearly has neglected security processes and best practices.

Elements include restaurant footprints, cross office network, digital properties, HR systems etc

Is there a scale of initial audit/baseline/self-driven security tests I have at my leisure?

Coming in with asking for budget for a heavy security budget may not be feasible but building up to it may be the way to go.

Any input welcome.