BeepRAT/Perplexity-AI Extension Omnibox Keystroke Exfil via suggest_url to perplexity-ai.online

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects a malicious Chrome extension exfiltrating keystrokes entered into the browser's Omnibox. The rule monitors for high-frequency GET requests (indicative of keystroke-by-keystroke transmission) from chrome.exe to a specific C2 domain (perplexity-ai.online), correlated with DNS resolution of that domain within the same session.