Fake Perplexity Chrome Extension Intercepted Searches and Collected Browsing Data
Summary
Microsoft researchers found a fake Perplexity Chrome extension routing searches through attacker infrastructure and collecting browsing activity. They found no evidence it stole credentials and advised users to remove it and rotate critical passwords.
Key points
- The “Search for perplexity ai” extension impersonated Perplexity AI and changed the browser’s default search provider.
- It routed address-bar searches and real-time suggestions through attacker-controlled infrastructure before redirecting users to legitimate search services.
- Microsoft reported that the extension collected browsing information but found no evidence it stole credentials or other sensitive information.
- The extension requested permissions for traffic redirection, URL rewriting, and selective request filtering, which could enable broader data collection.
- Users with extension ID flkebkiofojicogddingbdmcmkpbplcd should remove it and rotate critical account passwords.
- The fake extension used perplexity-ai[.]online, rather than the legitimate perplexity[.]ai domain.
Article Details
- Event Type
- Malicious Chrome browser extension impersonation and search-traffic interception
- Impact
- The extension collected browsing activity and routed search queries and real-time suggestions through attacker-controlled infrastructure before redirecting users to legitimate search services. Microsoft reported no evidence that it stole credentials or other sensitive information, but said its permissions could enable more extensive data theft. Affected users were advised to remove the extension and rotate critical passwords.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | perplexity-ai[.]online | Lookalike domain used by the malicious extension as attacker-controlled infrastructure to intercept and reroute search traffic. |
Products
Google ChromeMicrosoft found a malicious Chrome Web Store extension called “Search for perplexity ai” that impersonates Perplexity AI and reroutes search traffic through attacker-controlled infrastructure while collecting browsingPerplexityMicrosoft found a malicious Chrome Web Store extension called “Search for perplexity ai” that impersonates Perplexity AI and reroutes search traffic through attacker-controlled infrastructure while collecting browsing