Malicious Chrome Extension 'Search for perplexity ai' (flkebkiofojicogddingbdmcmkpbplcd) Install

Ibrahim Saud@tektrix

•updated Jun 30, 2026•5•0•13

This rule detects the creation or modification of core Chrome extension files (manifest.json, background.js, search.html) within the Chrome User Data directory by processes other than standard Chrome executables (chrome.exe, chromium.exe, googleupdate.exe). It also includes a specific alert for a known extension identifier. This activity is often indicative of unauthorized browser extension installation, potentially for persistence, credential theft, or malicious C2 activity.