Browser extension AI chat exfiltration

Security researcher Arnott observed the Poper Blocker browser extension exfiltrating URLs using character-mapping obfuscation and gated AI-chat scraping that activated after a 24-hour user-ID age, according to an AmIBeingPwned report. Arnott also observed CrxMouse exfiltrating URLs with base64 obfuscation and carrying the same remote-config infrastructure, though he did not observe CrxMouse explicitly exfiltrating AI chats during testing. Both extensions are published by Big Star Labs LP, a name matching a Delaware-registered "Big Star Labs" entity that AdGuard's Andrey Meshkov documented in a July 24, 2018 investigation as collecting browsing histories from more than 11 million users via Chrome extensions and mobile apps; whether the 2026 Big Star Labs LP is the same legal entity is not established in cited sources.

dropped url-status from 1 citation s with no available capture | ← Older revision | | Revision as of 13:48, 13 September 2026 | | | Line 89: | | Line 89: | | | | ===Big Star Labs LP=== | | ===Big Star Labs LP=== | | | Big Star Labs LP is the publisher of Poper Blocker & CrxMouse. Arnott observed Poper Blocker exfiltrating URLS<ref {{Cite web \|last=AmIBeingPwned \|title=Poper Blocker URL + AI Chat Exfiltration \|url=https://www.youtube.com/watch?v=jtExgNjBGMo ~~\|url-status=live~~ \|website=YouTube}}</ref with character-mapping obfuscation & gated AI-chat scraping that activated after a 24-hour user-ID age, & observed CrxMouse exfiltrating URLs with base64 obfuscation & carrying the same remote-config infrastructure, however Arnott did not observe CrxMouse explicitly exfiltrating AI-chats during the period of testing.<ref name="aibp-wall" / A name match exists with a 2018 AdGuard investigation by Andrey Meshkov, which documented a Delaware-registered ''"Big Star Labs"'' entity whose Chrome extensions & mobile apps were collecting browsing histories from more than 11 million users; AdGuard noted that ''"Every document that contains the company name is an image in other words, you cannot simply Google their name , they use different accounts in extension stores, and the domain owners aren't publicized."''<ref name="adguard" {{Cite web \|url=https://adguard.com/en/blog/big-star-labs-spyware.html \|title=Big Star Labs Spyware Campaign \|last=Meshkov \|first=Andrey \|work=AdGuard Blog \|date=July 24, 2018 \|access-date=May 29, 2026}}</ref Whether the 2026 ''"Big Star Labs LP"'' is the same legal entity is not established in cited sources; only the name match is. | | Big Star Labs LP is the publisher of Poper Blocker & CrxMouse. Arnott observed Poper Blocker exfiltrating URLS<ref {{Cite web \|last=AmIBeingPwned \|title=Poper Blocker URL + AI Chat Exfiltration \|url=https://www.youtube.com/watch?v=jtExgNjBGMo \|website=YouTube}}</ref with character-mapping obfuscation & gated AI-chat scraping that activated after a 24-hour user-ID age, & observed CrxMouse exfiltrating URLs with base64 obfuscation & carrying the same remote-config infrastructure, however Arnott did not observe CrxMouse explicitly exfiltrating AI-chats during the period of testing.<ref name="aibp-wall" / A name match exists with a 2018 AdGuard investigation by Andrey Meshkov, which documented a Delaware-registered ''"Big Star Labs"'' entity whose Chrome extensions & mobile apps were collecting browsing histories from more than 11 million users; AdGuard noted that ''"Every document that contains the company name is an image in other words, you cannot simply Google their name , they use different accounts in extension stores, and the domain owners aren't publicized."''<ref name="adguard" {{Cite web \|url=https://adguard.com/en/blog/big-star-labs-spyware.html \|title=Big Star Labs Spyware Campaign \|last=Meshkov \|first=Andrey \|work=AdGuard Blog \|date=July 24, 2018 \|access-date=May 29, 2026}}</ref Whether the 2026 ''"Big Star Labs LP"'' is the same legal entity is not established in cited sources; only the name match is. | | | ===Owned it Ltd=== | | ===Owned it Ltd=== |