ChatGPT Check Browser Extension

During our investigation of unreliable websites, our research team came across the ChatGPT Check browser extension. We encountered a webpage promoting the installation of this extension, alongside an "official" promotional page for ChatGPT Check.

On this official page, ChatGPT Check was presented as a tool for individuals who prefer not to create an account or pay for ChatGPT services. Supposedly, this browser extension offered the convenience of using the AI chatbot for up to three daily searches without the need for registration, and it was offered free of charge. However, upon a thorough analysis of this software, we determined that it operates as a browser hijacker, promoting the fake search engine chatcheckext.com.

It's crucial to underscore that this deceptive extension has no affiliation whatsoever with the legitimate ChatGPT or its developer, OpenAI.

In our testing, ChatGPT Check exhibited behavior consistent with browser hijackers. It altered the browser's default search engine, homepage, and the URL used for new tabs and windows, redirecting them to the chatcheckext.com website. Consequently, any attempts to open new tabs or perform search queries in the URL bar led to redirects to this site.

Fake search engines often lack the capability to provide genuine search results, which is why they frequently redirect users to established Internet search engines. At the time of our investigation, chatcheckext.com directed users to the Yahoo search engine (search.yahoo.com). However, it's important to note that this destination may vary based on factors like user location.

Browser-hijacking software typically employs tactics to maintain persistence, making it challenging to remove and preventing users from restoring their browsers. ChatGPT Check is no exception; the version we identified in the installer leverages the "Managed by your organization" feature in Google Chrome for this purpose.

Additionally, ChatGPT Check is designed to collect browsing history and may potentially gather other sensitive information. Browser hijackers often target data such as internet cookies, usernames, passwords, personally identifiable information, and financial data, which can then be monetized by selling it to third parties.

How Are Rogue Browser Extensions Commonly Distributed?

Rogue browser extensions are typically distributed through various deceptive methods, taking advantage of users' trust and curiosity. Here are common ways these malicious extensions are distributed:

• Malicious Websites: Users may come across rogue browser extensions when visiting compromised or malicious websites. These sites may prompt users to download and install extensions by falsely claiming they are necessary for viewing content or improving the browsing experience.
• Fake Software Updates: Malicious actors often disguise rogue extensions as software updates or security patches. Users are tricked into believing they need to install the extension to keep their browser or system secure.
• Freeware and Shareware: Some free software or shareware applications bundle rogue extensions with their installations. Users who do not carefully review the installation process may inadvertently install these extensions along with the desired software.
• Phishing Emails: Phishing emails may contain links or attachments that lead to websites promoting rogue extensions. Users who click on these links or download attachments may end up installing the malicious extensions.
• Malvertising: Malvertisements, or malicious advertisements, on websites may lead users to pages promoting rogue browser extensions. These ads often use enticing offers or fake alerts to encourage users to click and install.
• Browser Pop-Ups: Pop-up windows that claim to offer useful tools or enhancements to your browsing experience may actually lead to rogue extension installations when users click on them.
• Social Engineering: Malicious actors may employ social engineering tactics, such as impersonating tech support representatives or legitimate organizations, to convince users to install rogue extensions for supposed security or support purposes.
• Fake Download Sites: Users searching for popular browser extensions may encounter rogue versions of these extensions on unofficial download sites. These fake extensions can be bundled with malware or malicious behavior.