Browser extension AI chat exfiltration: Difference between revisions

Line 89:

===Big Star Labs LP===

Big Star Labs LP is the publisher of Poper Blocker & CrxMouse. Arnott observed Poper Blocker exfiltrating ~~URLs~~ with character-mapping obfuscation & gated AI-chat scraping that activated after a 24-hour user-ID age, & observed CrxMouse exfiltrating URLs with base64 obfuscation & carrying the same remote-config infrastructure, however Arnott did not observe CrxMouse explicitly exfiltrating AI-chats during the period of testing.<ref name="aibp-wall" /> A name match exists with a 2018 AdGuard investigation by Andrey Meshkov, which documented a Delaware-registered ''"Big Star Labs"'' entity whose Chrome extensions & mobile apps were collecting browsing histories from more than 11 million users; AdGuard noted that ''"Every document that contains the company name is an image (in other words, you cannot simply Google their name), they use different accounts in extension stores, and the domain owners aren't publicized."''<ref name="adguard">{{Cite web |url=https://adguard.com/en/blog/big-star-labs-spyware.html |title=Big Star Labs Spyware Campaign |last=Meshkov |first=Andrey |work=AdGuard Blog |date=July 24, 2018 |access-date=May 29, 2026}}</ref> Whether the 2026 ''"Big Star Labs LP"'' is the same legal entity is not established in cited sources; only the name match is.

Big Star Labs LP is the publisher of Poper Blocker & CrxMouse. Arnott observed Poper Blocker exfiltrating URLS<ref>{{Cite web |last=AmIBeingPwned |title=Poper Blocker URL + AI Chat Exfiltration |url=https://www.youtube.com/watch?v=jtExgNjBGMo |url-status=live |website=YouTube}}</ref> with character-mapping obfuscation & gated AI-chat scraping that activated after a 24-hour user-ID age, & observed CrxMouse exfiltrating URLs with base64 obfuscation & carrying the same remote-config infrastructure, however Arnott did not observe CrxMouse explicitly exfiltrating AI-chats during the period of testing.<ref name="aibp-wall" /> A name match exists with a 2018 AdGuard investigation by Andrey Meshkov, which documented a Delaware-registered ''"Big Star Labs"'' entity whose Chrome extensions & mobile apps were collecting browsing histories from more than 11 million users; AdGuard noted that ''"Every document that contains the company name is an image (in other words, you cannot simply Google their name), they use different accounts in extension stores, and the domain owners aren't publicized."''<ref name="adguard">{{Cite web |url=https://adguard.com/en/blog/big-star-labs-spyware.html |title=Big Star Labs Spyware Campaign |last=Meshkov |first=Andrey |work=AdGuard Blog |date=July 24, 2018 |access-date=May 29, 2026}}</ref> Whether the 2026 ''"Big Star Labs LP"'' is the same legal entity is not established in cited sources; only the name match is.

===Owned it Ltd===

@@ Line 89: / Line 89: @@
 ===Big Star Labs LP===
-Big Star Labs LP is the publisher of Poper Blocker & CrxMouse. Arnott observed Poper Blocker exfiltrating URLs with character-mapping obfuscation & gated AI-chat scraping that activated after a 24-hour user-ID age, & observed CrxMouse exfiltrating URLs with base64 obfuscation & carrying the same remote-config infrastructure, however Arnott did not observe CrxMouse explicitly exfiltrating AI-chats during the period of testing.<ref name="aibp-wall" /> A name match exists with a 2018 AdGuard investigation by Andrey Meshkov, which documented a Delaware-registered ''"Big Star Labs"'' entity whose Chrome extensions & mobile apps were collecting browsing histories from more than 11 million users; AdGuard noted that ''"Every document that contains the company name is an image (in other words, you cannot simply Google their name), they use different accounts in extension stores, and the domain owners aren't publicized."''<ref name="adguard">{{Cite web |url=https://adguard.com/en/blog/big-star-labs-spyware.html |title=Big Star Labs Spyware Campaign |last=Meshkov |first=Andrey |work=AdGuard Blog |date=July 24, 2018 |access-date=May 29, 2026}}</ref> Whether the 2026 ''"Big Star Labs LP"'' is the same legal entity is not established in cited sources; only the name match is.
+Big Star Labs LP is the publisher of Poper Blocker & CrxMouse. Arnott observed Poper Blocker exfiltrating URLS<ref>{{Cite web |last=AmIBeingPwned |title=Poper Blocker URL + AI Chat Exfiltration |url=https://www.youtube.com/watch?v=jtExgNjBGMo |url-status=live |website=YouTube}}</ref> with character-mapping obfuscation & gated AI-chat scraping that activated after a 24-hour user-ID age, & observed CrxMouse exfiltrating URLs with base64 obfuscation & carrying the same remote-config infrastructure, however Arnott did not observe CrxMouse explicitly exfiltrating AI-chats during the period of testing.<ref name="aibp-wall" /> A name match exists with a 2018 AdGuard investigation by Andrey Meshkov, which documented a Delaware-registered ''"Big Star Labs"'' entity whose Chrome extensions & mobile apps were collecting browsing histories from more than 11 million users; AdGuard noted that ''"Every document that contains the company name is an image (in other words, you cannot simply Google their name), they use different accounts in extension stores, and the domain owners aren't publicized."''<ref name="adguard">{{Cite web |url=https://adguard.com/en/blog/big-star-labs-spyware.html |title=Big Star Labs Spyware Campaign |last=Meshkov |first=Andrey |work=AdGuard Blog |date=July 24, 2018 |access-date=May 29, 2026}}</ref> Whether the 2026 ''"Big Star Labs LP"'' is the same legal entity is not established in cited sources; only the name match is.
 ===Owned it Ltd===