Malicious Perplexity AI Extension Omnibox Keystroke Exfiltration

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects activity associated with the malicious 'Search for perplexity ai' browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd). It specifically identifies DNS queries and network connections to the malicious domain 'perplexity-ai.online' initiated by common web browser processes, as well as file system evidence of the extension's presence.