Malicious Perplexity AI Extension Promoted via Tilda Landing Page

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

This rule detects network activity and email signals associated with a malicious campaign promoting a fraudulent 'Perplexity AI' Chrome extension. It monitors for connections to known malicious Tilda landing pages, correlates these visits with subsequent Google Chrome extension (CRX) downloads within a 10-minute window, and identifies phishing emails containing links to these malicious pages.