The IA extension that deceived users the Perplexity imposter that recorded each search and each key

Microsoft detected a malicious extension for Chrome posing as the search engine for IA Perplexity and, instead of just offering results,. In plain view the results returned to Perplexity, Google or Bing, but the previous step - to an impostor web - was the point of capture: browser query and metadata were stored before the user saw the legitimate results.

The technique combines two abuses that should be understood: on the one hand, the extension is self-assigned as a default search provider (a legitimate functionality that Chrome allows), and on the other, it redirects the requests using network rules that the extension requested by means of permissions (the NetRequest API). In addition, it modified the browser's live suggestion URL to send each character that the user type to the attacking server, which increases the risk because not only complete searches are sent but also partially written data that may contain sensitive fragments.

The implications are serious: even without evidence of direct password theft, the attacker gets the combination of queries, headers, IP address and user agent, useful information for profiling, correlation with other data leaks and targeted phishing preparations. The design also included disable rules for Google and Bing and the possibility of running WebAssembly later, suggesting an architecture designed to scale or activate more dangerous functionalities when the operator decides.

This case is part of a broader trend: extensions that are heard in IA brands to gain confidence and permissions, and then abuse the extension's ability to rewrite traffic or spy on chats and searches. Platforms and administrators should deal with the tools that promise "IA improvements" with particular mistrust and request evidence of provenance and transparency of the code where possible. Perplexity and other legitimate services are used as decoy, but the brand alone does not imply reliability.

What to do now if you use Chrome as a particular: immediately uninstall any suspicious extension with names that mimic IA services; check and re-establish your default search engine in the browser settings; review the list of extensions and their permissions, and remove those that request the ability to rewrite traffic or access all pages. Although Microsoft found no evidence of password theft, if you wrote sensitive data while the extension was active, consider changing passwords and reviewing abnormal activity in your accounts.

Tips for companies and administrators: prevents the free installation of extensions using corporate policies - allowing only a white list - and monitors changes in search settings and DNS traffic to unknown domains as a warning signal. Integrate these detections into your EDR solutions and check the log for connections to domains that mimic known brands. Consider also the browser isolation for users with access to sensitive data and apply the less privileged policy to extensions.

If you want to deepen the technical capacity these extensions use to intercept and manipulate requests, Chrome's declarativeNetRequest API documentation explains how network rules are developed in extensions: DeclarativeNetRequest. For security context and Microsoft warnings about threats to browsers and extensions, see the official Microsoft security blog: Microsoft Security Blog. It is also appropriate to visit the official Perplexity page to verify legitimate domains and services before installing tools that are identified with that brand: Perplexity.ai.

In summary, the practical lesson is not to delegate confidence in the name of an application or in the promise of "IA": check permissions, origin and domain, limit the permitted extensions in corporate environments and respond soon if you detect changes in the search engine or traffic to impostor domains.