Malicious Extension flkebkiofojicogddingbdmcmkpbplcd Omnibox Keystroke Exfil to perplexity-ai.online

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule monitors for malicious Chrome extension activity involving the redirection of address bar inputs to an unauthorized domain (perplexity-ai.online). It identifies indicators of compromise across device network logs (connectivity to the malicious C2), file system events (presence of the identified malicious extension identifier), and generic device events (log entries containing the malicious extension ID or C2 URL). This pattern is indicative of a browser-based keystroke exfiltration attack.