Malicious Perplexity AI Chrome Extension Search Hijack (flkebkiofojicogddingbdmcmkpbplcd)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects evidence of a malicious browser extension, identified by extension ID flkebkiofojicogddingbdmcmkpbplcd, designed to redirect search traffic through a typosquatted domain 'perplexity-ai.online'. The rule monitors for file-system creation of the malicious extension, modifications to browser preferences files, manipulation of system registry keys to enforce the search provider, and outbound network connections to the malicious domain from major web browsers.