Overview
- Security firm Koi reported that Urban VPN Proxy began capturing prompts and responses from ChatGPT, Claude, Gemini, Copilot, Perplexity, DeepSeek, Grok, and Meta AI after a July 9, 2025 update.
- More than seven to eight million users were exposed across Chrome and Edge installs of Urban VPN Proxy and seven sibling extensions carrying identical code.
- Captured chat data was routed to BiScience, an affiliated data broker, with Urban Cybersecurity’s privacy materials describing sharing for marketing analytics.
- The scraping ran by default through silent auto‑updates, offered no user-facing opt‑out, and could only be stopped by uninstalling the extensions.
- Malwarebytes observed Urban Cybersecurity listings removed from the Chrome Web Store while the Microsoft Edge versions were still available at the time of reporting, despite prior “Featured” badges and high ratings.