Malicious Chrome Extension Captured Searches and Address-Bar Input
Summary
Microsoft found a Perplexity-impersonating Chrome extension that sent searches and address-bar keystrokes to an attacker-controlled server before redirecting users to real results. Google removed it; Microsoft found no proof of password theft.
Key points
- The extension, “Search for perplexity ai,” impersonated Perplexity and set itself as the browser’s default search engine.
- It routed search queries through perplexity-ai[.]online, where the server logged requests along with browser headers, IP addresses, and user agents.
- Its live search suggestions also sent each character typed in the address bar to the attacker before users pressed Enter.
- The extension redirected users to genuine Perplexity, Google, or Bing results, making the searches appear normal.
- Microsoft said server-side logging indicated deliberate collection; it found no proof of password theft.
- Google removed the extension after Microsoft disclosed it. The operator and the number of installs were not disclosed.
- Users should remove the extension and check their search settings; organizations should restrict extensions to approved ones and monitor for suspicious permissions or traffic.
Article Details
- Event Type
- Microsoft disclosed a malicious Chrome extension impersonating Perplexity that intercepted search queries and address-bar input.
- Impact
- The extension sent searches and typed characters to the attacker-controlled domain perplexity-ai[.]online, along with browser headers, IP address, and user agent, before redirecting users to genuine search results. Microsoft found no proof of password theft. Google removed the extension from the Chrome Web Store after disclosure.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | perplexity-ai[.]online | Attacker-controlled domain used by the extension to collect search queries and address-bar input before redirecting users to genuine search results. |
Vendors
GoogleMicrosoft says Google removed it from the store after responsible disclosure.MicrosoftMicrosoft uncovered a malicious Chrome extension called “Search for perplexity ai” that impersonated Perplexity and siphoned every search query and even keystrokes from the address bar through an attacker-controlled
Products
Google ChromeMicrosoft uncovered a malicious Chrome extension called “Search for perplexity ai” that impersonated Perplexity and siphoned every search query and even keystrokes from the address bar through an attacker-controlledPerplexityMicrosoft uncovered a malicious Chrome extension called “Search for perplexity ai” that impersonated Perplexity and siphoned every search query and even keystrokes from the address bar through an attacker-controlled