Chrome Search Hijack via flkebkiofojicogddingbdmcmkpbplcd Spoofing Perplexity AI

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects the installation and activity of a malicious Google Chrome extension used to hijack the browser's default search provider. The rule triggers on a multi-stage process involving the creation of a specific malicious extension directory, modification of the Chrome Preferences file to change search settings, tampering with the 'PreferenceMACs' registry keys to bypass browser-based integrity warnings, and subsequent network communication with a known malicious C2 domain associated with the search hijack.