Welcome to 2026: Microsoft Office Exploited, Chrome Extensions Stealing AI Chats

Hey there,

Cipherceval here with your weekly dose of cybersecurity chaos. Episode 60 just dropped, and let me tell you — 2026 is not messing around. We've got five major stories this week, and honestly, any one of them could have been its own episode.

Let's break it down.

The bottom line: Microsoft dropped an emergency out-of-band patch for an actively exploited zero-day affecting Office 2016 through Microsoft 365.

What's happening: This is a security feature bypass that lets attackers circumvent OLE mitigations. In plain English? The security check is looking at something the attacker controls — and the attacker lies.

The good news: It's not a preview pane attack. You have to actually open a malicious file.

The bad news: Tricking users into opening Office documents has never been an insurmountable problem for attackers. That's literally the bread and butter of phishing campaigns.

What you need to do:

Cipher-ism: Update your stuff. A patch does you no good if it isn't installed.

CVSS Score: 10.0 — That's the golden goose of hacking.

What is it: Modular DS is a WordPress plugin that lets you manage multiple sites from one dashboard. Over 40,000 active installations. Convenient, right? Well, the problem with convenience is it usually comes at the cost of security.

The vulnerability: Unauthenticated privilege escalation. Here's the attack chain:

Yes, really. A magic parameter grants admin access. Security by obscurity does not work, folks.

Timeline:

Attacker IPs: 45.11.89.19, 185.196.0.11

Post-compromise IOCs: Rogue admin accounts like "support2026" or "admin_backup", malicious plugins/themes

Action required: Update to version 2.6.0 or later. Not 2.5.2 — specifically 2.6.0+. Then audit your admin users and installed plugins.

Campaign name: Prompt Poaching (great name, honestly)

The discovery: OX Security researchers found two malicious Chrome extensions exfiltrating ChatGPT and DeepSeek conversations to attacker-controlled C2 servers. Every 30 minutes, your data gets batched up, base64 encoded, and shipped off.

The scale: 900,000+ downloads combined.

The kicker: One of them — "ChatGPT for Chrome with GPT-5, Claude Sonnet, and DeepSeek AI" — had Google's Featured badge. You know, the mark that's supposed to indicate quality and trust.

The extensions:

C2 domains: deepaichats[.]com, chatsaigpt[.]com

Technical details: They leverage the Chrome tabs.onUpdated API to detect when you navigate to ChatGPT or DeepSeek, then interact directly with the DOM to extract prompts, responses, and session metadata.

Why it matters: Think about what people share with AI chatbots — proprietary code, business strategies, customer data, internal URLs, corporate secrets. That data can be weaponized for espionage, identity theft, or sold on underground forums.

The law of spam applies: Cast a wide enough net, and someone will bite. 900,000 people installed these.

Action: Remove these extensions immediately. Be skeptical of ANY browser extension, even ones with good ratings and featured badges.

Threat actor: Crimson Collective

Victim: Brightspeed — US fiber broadband provider operating across 20 states, serving 1M+ customers

Claimed data: Names, billing addresses, email addresses, phone numbers

Status: Investigation ongoing. Brightspeed has NOT confirmed a breach occurred.

The bigger picture: This is part of a broader 2026 trend — extortion groups increasingly targeting telecoms and ISPs because of the sheer volume of customer data they hold.

If you're a Brightspeed customer: Watch for phishing attempts using any exposed information to seem more legitimate. When in doubt, find an official phone number and call the company directly.

This one is... infuriating. Disappointing. Like, what even is this?

The defendants:

The charges: Conspiracy to commit extortion as BlackCat/ALPHV ransomware affiliates

Let that sink in. One guy was doing incident response — helping companies recover from attacks. The other was a ransomware negotiator — someone companies hired to negotiate with attackers. And they were both moonlighting as ransomware affiliates.

The numbers:

Sentencing: March 2026, up to 20 years each

The lesson: Security is just as much about people as it is about technology. The insider threat is real. Background checks matter. Continuous monitoring matters. Least privilege matters — even for your security team.