Malicious Perplexity Chrome Extension Intercepted Searches and Address Bar Input

Summary: Microsoft found a malicious Chrome extension called "Search for perplexity ai" (ID flkebkiofojicogddingbdmcmkpbplcd) that posed as Perplexity using the look-alike domain perplexity-ai[.]online and set itself as the browser's default search engine. Every query and every character typed into the address bar was sent to an attacker-controlled server, logged with browser headers, IP address, and user agent, then redirected to a real search engine so results looked normal; Google removed it after responsible disclosure.
Key Takeaway: The extension also shipped disabled redirect rules for Google and Bing and left room to run WebAssembly later, and Microsoft's related research tied a chat-skimming wave to roughly 900,000 installs across more than 20,000 company networks - so the same machinery is already at scale inside enterprise browsers.

Read the original at The Hacker News ↗