Malicious Chrome Extension flkebkiofojicogddingbdmcmkpbplcd Overbroad declarativeNetRequest Permissions

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects the presence of a specific malicious Chrome extension ID (flkebkiofojicogddingbdmcmkpbplcd) in process command lines or file paths on Windows endpoints, originating from browser processes such as Chrome, Edge, or Brave.