Photo ZIP Campaign: Perplexity AI Extension Two-Hop Redirect Chain to ZIP Lure

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects a malicious browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that masquerades as Perplexity AI. The rule identifies the extension installation followed by a two-hop network redirect sequence: the browser is first directed to a malicious domain (perplexity-ai.online) which logs user metadata, then immediately redirected to a ZIP file download lure on a different domain. This behavior is correlated within a 30-minute window for a specific browser process.