Malicious 'Search for perplexity ai' Extension Search Hijack (flkebkiofojicogddingbdmcmkpbplcd)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

This rule detects installation artifacts, configuration file modifications, registry changes, and network activity associated with a specific malicious Chromium extension ('flkebkiofojicogddingbdmcmkpbplcd') that hijacks the default browser search provider via declarativeNetRequest rules and communicates with a typosquatted domain 'perplexity-ai.online'.