Malicious Perplexity Chrome Extension Intercepts User Data

Malicious Perplexity Chrome Extension: A Deep Dive into Data Interception

A recent discovery by Microsoft threat intelligence has unveiled a concerning incident involving a malicious Chrome extension masquerading as the popular AI search engine Perplexity. This extension was found to be actively intercepting users’ search queries and address bar inputs, routing all data through an attacker-controlled server before eventually redirecting users to legitimate search results. This sophisticated [TTP](/glossary#ttp) highlights the ongoing risks associated with third-party browser extensions and the imperative for vigilant digital hygiene among security professionals and end-users alike.

Overview of the Malicious Perplexity Chrome Extension Data Interception

The malicious Perplexity Chrome extension data interception scheme operated by covertly logging every character typed into the browser’s address bar and every search query initiated by the user. According to The Hacker News, this sensitive information was first transmitted to an adversary-controlled server. Only after this initial exfiltration did the extension proceed to forward the requests to the actual Perplexity AI service or other search engines, creating a seamless, albeit compromised, user experience. Microsoft’s prompt responsible disclosure to Google led to the extension’s removal from the Chrome Web Store, mitigating further immediate risk. However, the incident serves as a critical reminder of how easily trust can be exploited within application ecosystems.

Technical Analysis of the Threat Mechanism

The operational mechanism of this malicious extension is a classic example of Man-in-the-Browser (MiTB) attack capabilities, albeit delivered via an extension. By injecting itself into the browser’s core functionalities, it gained the ability to:

• Intercept Input: Capture keystrokes from the address bar and search fields.
• Exfiltrate Data: Send captured data to a [C2](/glossary#c2) (command and control) server managed by the attackers.
• Maintain Stealth: Redirect users to expected results, ensuring the compromise remains undetected by the average user.

The implications of such data interception are substantial. Adversaries could collect vast amounts of information, including personal interests, proprietary company searches, URLs containing sensitive session tokens, and even attempts to access internal corporate applications. This data can be leveraged for targeted [Phishing](/glossary#phishing) campaigns, identity theft, or reconnaissance for more significant cyberattacks. The threat actor’s ability to seamlessly proxy traffic demonstrates a well-planned strategy for data harvesting, blurring the lines between legitimate browser functionality and malicious activity.

Mitigation Steps for Browser Extension Threats

Defending against threats posed by malicious browser extensions requires a multi-layered approach, combining user education with robust technical controls. Security professionals should prioritize the following recommendations:

• Audit and Prune Extensions: Regularly review all installed browser extensions. Uninstall any that are not essential, from unknown developers, or have excessive permissions. Scrutinize reviews, developer details, and installation counts.
• Restrict Permissions: When installing new extensions, carefully review the requested permissions. Grant only the minimum necessary permissions for the extension’s intended functionality.
• Source Verification: Only install extensions from official and reputable sources. Even then, exercise caution, as evidenced by this case where a malicious extension was initially available on the official store.
• Implement Browser Security Policies: In enterprise environments, leverage Group Policies or equivalent management tools to control extension installations. Consider whitelisting approved extensions and blocking all others.
• Enhanced Monitoring: Deploy [EDR](/glossary#edr) solutions capable of monitoring browser processes and network connections for unusual activity originating from browser components. [SIEM](/glossary#siem) systems should be configured to flag suspicious network flows to potential C2 infrastructure.
• User Education: Conduct regular training for employees on how to detect malicious browser extensions and the dangers of installing unverified software. Emphasize checking for developer legitimacy, reading permissions carefully, and being wary of extensions asking for broad access to browser data.
• Adopt [Zero Trust](/glossary#zero-trust) Principles: Apply Zero Trust principles to browser environments, assuming no extension or user action is inherently trustworthy without verification. This includes continuous authentication and authorization for browser activities and data access.

This incident underscores that the browser remains a primary attack vector. By understanding the TTPs involved in such [Supply Chain Attack](/glossary#supply-chain-attack) scenarios (even if indirect through impersonation) and implementing proactive defenses, organizations can significantly reduce their exposure to similar threats.