Malicious Chromium Extension Spoofs Perplexity AI to Hijack Browser Searches

A malicious Chromium extension that impersonated the Perplexity AI brand to intercept browser searches and capture keystrokes before delivering users to legitimate search results.

The extension, listed as “Search for perplexity ai” (ID flkebkiofojicogddingbdmcmkpbplcd, version 2.2), used Manifest V3 capabilities, declarativeNetRequest (DNR) rules, and a typosquatted domain perplexity-ai[.]online to create a stealthy two‑hop interception pipeline that logs queries and associated telemetry to attacker-controlled infrastructure.

Microsoft reported the extension to Google and it has been removed from the Chrome Web Store access at the time of writing.

At installation the extension set itself as the default search provider via chrome_settings_overrides, routing both completed Omnibox queries and suggest_url requests (every character typed) to the attacker domain.

The extension then relied on DNR rules to immediately redirect the browser to the expected search engine (Perplexity, Google, or Bing), leaving the visible results intact while the first hop to the malicious server captured full query strings, HTTP headers, user-agent and source IP.

The extension’s manifest and included server-side code (server.js and nginx.conf) show the interception was intentional: server.js proxies requests, logs incoming headers, and adds permissive CORS; nginx.conf provides HTTPS and proxying for the /search endpoint.

This architecture turns a seemingly innocuous AI search add‑on into a powerful surveillance and data-collection mechanism.

Chromium Extension Spoofs Perplexity AI

Several technical choices increased the extension’s stealth and capability. Use of the suggest_url field meant the operator received real-time keystroke-level data before the user submitted a query, effectively performing active user surveillance rather than simple redirection.

Microsoft Threat Intelligence has identified a malicious Chromium based extension that spoofs the AI-powered answer engine Perplexity AI to trick unsuspecting users into installing it. 

The DNR permissions requested declarativeNetRequest, declarativeNetRequestFeedback, and declarativeNetRequestWithHostAccess enabled redirection, monitoring of which rules fired, and host-scoped interception, a combination that exceeds what a legitimate AI search assistant reasonably requires.

The extension also included an unusual content_security_policy permitting Wasm evaluation, enabling future expansion without republishing manifest changes.

The threat model is straightforward but impactful: by typosquatting a trusted AI brand and mimicking onboarding UX, operators increased installation likelihood.

After installation, users observed normal search behavior while the attacker-side infrastructure harvested rich signals that can feed profiling, targeted advertising, ad-fraud, or other misuse depending on adversary intent.

Microsoft found no definitive evidence of credential theft in this sample, but the breadth of collected telemetry and elevated permissions represent a material privacy and security risk.

This case highlights two broader trends. First, browser extensions remain a high-value attack surface because they gain privileged access to APIs and user traffic.

Second, adversaries increasingly weaponize AI branding and the current AI hype as social-engineering vectors spoofing recognizable AI services to lower user suspicion.

Microsoft ties this to research showing threat actors operationalize AI both as a technical capability and as a lure.

Defensive guidance is straightforward: enterprises should enforce extension allow‑listing and apply policy controls to block untrusted extensions; monitor for unauthorized changes to browser search settings and outbound traffic to unfamiliar intermediary domains; and flag extensions requesting search-override or powerful network-manipulation APIs.

Platform protections such as Microsoft Defender SmartScreen, Edge’s extension governance, and continuous store review processes provide additional layers of mitigation.

Microsoft has published detailed indicators, dynamic-analysis findings and advanced hunting queries to aid detection and response; organizations should ingest these signals and correlate behavioral telemetry with reputation feeds.

The removal of this extension from the Chrome Web Store mitigates immediate exposure, but the underlying tactics typosquatting trusted AI brands, leveraging MV3/DNR for silent interception, and shipping server-side logging are repeatable.

Security teams and users must remain vigilant as threat actors continue to exploit AI branding and browser extension privileges to harvest sensitive browsing activity.

Indicators of compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.