There's a startup making botnets using Chrome extensions?
Source: YouTube · Theo - t3․gg · published Jul 14, 2025 · 23:46
Browser extensions with the Melotell library have turned nearly 1 million browsers into an unwitting web scraping botnet 0:00.
Key Takeaways:
• The AI race has dramatically increased data demand while websites like Twitter and Reddit have restricted API access, creating incentives for scraping 0:35-0:57.
• Melotell pays developers to integrate their library, which uses hidden iframes to scrape websites without user knowledge 6:24-6:33.
• Browser extensions are ideal for scraping because they distribute requests across many IP addresses, avoiding blocks from sites like Reddit 11:25-11:52.
• The library removes security headers like CSP and X-Frame-Options, making users vulnerable to cross-site scripting attacks 14:55-15:35.
Browser extensions can be more dangerous than mobile apps due to their extensive permissions, so users should audit extensions carefully 23:18-23:31.
Sources:
- 0:00 Introduction to botnet problem
- 0:35-0:57 AI data demand and API restrictions
- 6:24-6:33 How Melotell library works
- 11:25-11:52 Why extensions are used for scraping
- 14:55-15:35 Security header removal
- 23:18-23:31 Warning about extension permissions
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Browser extensions turn nearly 1 million browsers into website scraping bots. Oh boy, two of my least favorite things. Chrome extensions and botn nets. This is quite the story. As soon as I saw this shared by my chat, I knew I had to talk about it because I know too much about all of the pieces here. I've built some very popular Chrome extensions and had people burn novel exploits to get into Google accounts just to get into my dashboard or to publish malware. People underestimate how dangerous Chrome extensions are, as well as how much incentive there is to turn people's devices into botn nets. There has never been more need for data than there is now because we're in the AI race and everyone needs data to train their models to do all the things that we want to do with AI. At the same tim…