Microsoft says fake Perplexity Chrome extension logged users’ searches

A malicious browser extension posing as the popular Perplexity AI service was discovered intercepting and logging users' search queries, Microsoft researchers revealed. The extension, called "Search for perplexity ai," was removed from the Chrome Web Store after Microsoft's disclosure, but it remains installed on the browsers of users who downloaded it.

The extension impersonated the legitimate AI search company by using similar branding and a typosquatted domain, perplexityai.online, instead of the official perplexity.ai. Once installed, it used standard Chrome permissions to set itself as the browser's default search engine. Searches typed into the address bar, including real-time autocomplete suggestions, were first routed through an attacker-controlled server. This server logged the search queries along with the user's IP address, browser headers, and other metadata before silently redirecting the request to a legitimate search engine like Google, Bing, or Perplexity, delivering normal-looking results.

Microsoft's analysis concluded the primary objective was surveillance and data collection. The extension requested powerful "declarativeNetRequest" permissions, which allowed...