A deceptive browser extension posing as the popular Perplexity AI search platform was quietly siphoning user search activity — including every character typed into Chrome's address bar — before anyone realized it existed. The discovery, attributed to Microsoft's security researchers, offers a stark reminder of how easily trusted brand names can be weaponized to compromise user privacy at scale.
A Trojan Horse in the Browser Store
The extension presented itself as a legitimate companion tool for Perplexity, an AI-powered search engine that has gained significant traction among users seeking conversational, citation-backed answers. By piggybacking on a recognizable and trusted brand, the threat actor dramatically lowered the barrier to installation — users had every reason to believe the extension was authentic.
Once installed, the extension operated with surgical precision. Rather than doing anything visually alarming, it silently intercepted outbound search queries and address bar input, routing that data through an attacker-controlled server. From the user's perspective, searches functioned normally — results appeared as expected, and nothing seemed amiss. That invisibility is precisely what made this campaign so dangerous.
The most effective surveillance tools are the ones that never announce themselves. By delivering a fully functional user experience, the extension could persist undetected for extended periods while continuously exfiltrating sensitive query data.
What Was Actually Being Stolen
The scope of data interception here should not be understated. Browser address bar input is remarkably sensitive. Users routinely type partial URLs, internal domain names, personal search terms, account-related queries, and sensitive topics directly into the omnibox — often without thinking of it as a data entry point at risk of surveillance.
By capturing this stream in real time, an attacker gains access to a continuous behavioral profile of the victim: what they're researching, what services they use, what problems they're trying to solve, and potentially what credentials or internal resources they're navigating toward. This type of passive intelligence gathering has clear value for targeted phishing, corporate espionage, and identity-based attacks.
The Broader Problem with Extension Trust
Google's Chrome Web Store has long struggled with the challenge of vetting the thousands of extensions submitted to its platform. While Google has made incremental improvements to its review processes, the sheer volume of submissions — combined with the ability for developers to update extension behavior post-approval — creates persistent blind spots.
Impersonation extensions are a particularly insidious variant of this problem. They exploit the reputational equity of well-known brands to bypass user skepticism. A user searching for a Perplexity browser integration is far more likely to install what appears to be an official or affiliated tool without scrutinizing its permissions or developer credentials.
Following Microsoft's responsible disclosure, Google moved to remove the extension from the Web Store. But removal after the fact does little for users who had already installed and run it during its active window.
The AI Brand Exploitation Angle
It is worth noting that this attack specifically targeted the identity of an AI platform — not a legacy software brand. As AI tools become embedded in everyday workflows, their associated browser extensions, desktop clients, and integrations will become increasingly attractive impersonation targets. Threat actors follow user adoption curves. The rapid mainstream uptake of AI search and productivity tools means this category of brand spoofing will almost certainly grow more prevalent.
Security teams should treat AI tool extensions with the same scrutiny applied to any privileged browser plugin — perhaps more, given the novelty of the category and the relative inexperience many users have in evaluating them.
What You Should Do
Key Takeaways
This incident encapsulates a threat model that is easy to underestimate: a fully functional, visually convincing tool that causes no disruption while quietly harvesting intelligence. The attack required no exploitation of a software vulnerability, no phishing email, and no malware in the traditional sense — just a convincing name, a functional interface, and the implicit trust users place in app stores.
As the AI ecosystem continues to expand, the attack surface represented by browser extensions tied to these platforms will expand with it. Vigilance at the point of installation is no longer optional — it is a foundational security habit for anyone operating in today's browser-centric work environment.
