Browser extension with DNR + content scripts targets AI assistant domains

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•6

This rule detects the installation or operation of browser extensions that request overly broad host permissions (e.g., all URLs) or specifically target popular AI services (like Gemini, Copilot, or Claude). It also monitors the use of the declarativeNetRequest API to interact with these same AI service domains, which is a technique used by malicious extensions to intercept or manipulate web traffic.