BotBrowser extension confirmed as API key stealer trojan

/g/ · 10 mentions · novelty breaking · first seen 2026-06-09 11:42

structuredprefill botbrowser sillytavern trojan malware botbrowser extension structuredprefill extension

Key claims

The BotBrowser extension for SillyTavern is a confirmed trojan that exfiltrates API keys; users should remove it and rotate credentials.
A popular SillyTavern extension is malware designed to steal API credentials from users.
BotBrowser extension for SillyTavern is malware that steals API keys, with StructuredPrefill by the same author also suspected to be compromised.
BotBrowser extension for SillyTavern is malicious and steals API keys; StructuredPrefill by the same author is also suspected to be compromised.
A malicious browser extension distributed to AI chatbot users is stealing API credentials and rotating keys is recommended.
A widely-used browser extension for SillyTavern has been confirmed to contain malicious code that exfiltrates API credentials.

Volume over time

Peak 2 mentions/hour · 9 hourly buckets

Source threads (10)

Every thread this story was extracted from, with live and archive links so the evidence is verifiable.

/g/109076349 ↗ live · archive alarmed breaking 368 replies The BotBrowser extension for SillyTavern is a confirmed trojan that steals API keys, and StructuredPrefill by the same author is suspected compromised.
/g/109081623 ↗ live · archive alarmed breaking 68 replies A widely-used browser extension for SillyTavern has been confirmed to contain malicious code that exfiltrates API credentials.
/g/109067454 ↗ live · archive alarmed breaking 340 replies The BotBrowser extension for SillyTavern is malware that steals API keys; StructuredPrefill by the same author is suspected compromised.
/g/109059674 ↗ live · archive alarmed breaking 358 replies A malicious browser extension distributed to AI chatbot users is stealing API credentials and rotating keys is recommended.
/g/109052183 ↗ live · archive alarmed breaking 384 replies A malicious browser extension distributed to AI chatbot users is stealing API credentials and rotating keys is recommended.
/g/109042550 ↗ live · archive alarmed breaking 343 replies BotBrowser extension for SillyTavern is malicious and steals API keys; StructuredPrefill by the same author is also suspected to be compromised.
/g/109031810 ↗ live · archive alarmed breaking 437 replies BotBrowser extension for SillyTavern is malware that steals API keys, with StructuredPrefill by the same author also suspected to be compromised.
/g/109022746 ↗ live · archive alarmed breaking 386 replies A popular SillyTavern extension is malware designed to steal API credentials from users.
/g/109017656 ↗ live · archive alarmed breaking 376 replies The BotBrowser extension for SillyTavern is a confirmed trojan that exfiltrates API keys; users should remove it and rotate credentials.
/g/109000358 ↗ live · archive alarmed breaking 391 replies Popular SillyTavern browser extension was compromised and used to steal API credentials; related extension suspected.