Ethical Hacking News
A malicious Chrome extension has been discovered that posed as an AI search engine, intercepting user searches and collecting sensitive data. Microsoft has warned users to remove the extension and implement browser security measures to protect themselves from potential threats.
The "Search for perplexity ai" Chrome extension was found to be malicious, posing a significant threat to user data security. The extension intercepted searches and collected user data, including browser headers, IP addresses, and user agents, without the user's consent. The extension had disabled redirect rules for Google and Bing at first but could be re-enabled later, expanding its scope of interception. Microsoft advises users to remove the extension and implement browser security measures, such as only allowing approved extensions and treating AI-branded tools with extra suspicion.
Malicious Perplexity Chrome Extension Intercepted Searches and Address Bar Input
A recent discovery by Microsoft's Defender research team has shed light on a malicious Chrome extension that posed as the AI search engine Perplexity, posing a significant threat to user data security. The extension, identified as "Search for perplexity ai" (ID flkebkiofojicogddingbdmcmkpbplcd), was found to quietly log what people searched for and routed every query and every character typed into the address bar through an attacker-controlled server before redirecting users to real results.
The extension's AI branding served as a clever disguise, deceiving users into installing it. However, upon closer inspection, Microsoft revealed that the search override did not collect data on AI chats but rather intercepted searches and collected user data, including browser headers, IP addresses, and user agents. This malicious activity was made possible by the extension's ability to rewrite and redirect user traffic, which is a clear violation of the permissions required for legitimate extensions.
Furthermore, Microsoft discovered that the extension shipped disabled redirect rules for Google and Bing, allowing it to be re-enabled later, thus expanding its scope of interception. Additionally, the extension included room for running WebAssembly code, which is not typically found in search tools, suggesting that it was designed to perform more malicious activities than initially apparent.
The incident highlights a growing trend of malicious extensions masquerading as AI-powered tools, targeting user data and exploiting vulnerabilities in Chrome's extension system. As users increasingly rely on the internet for information and tasks, it has become essential to remain vigilant about potential threats lurking in seemingly legitimate extensions.
In response to this incident, Microsoft advises users to remove the "Search for perplexity ai" extension and check that their default search engine has not been changed. Furthermore, the company suggests implementing browser security measures such as allowing only approved extensions through the browser or company policy, watching for changed search settings, and treating AI-branded tools with extra suspicion before installing.
As cybersecurity threats continue to evolve, it is crucial for users and organizations alike to stay informed about potential risks and take proactive steps to protect themselves. The recent discovery of this malicious Chrome extension serves as a stark reminder of the importance of exercising caution when using online services and applications.
Related Information:
https://www.ethicalhackingnews.com/articles/A-Malicious-Chrome-Extension-A-Threat-to-User-Data-Security-ehn.shtml
https://thehackernews.com/2026/06/malicious-perplexity-chrome-extension.html
Published: Wed Jul 1 13:24:02 2026 by llama3.2 3B Q4_K_M
