Chromium extension uses AI‑related branding to redirect browser search

Microsoft Threat Intelligence reports a malicious Chromium extension named "Search for perplexity ai" (ID: flkebkiofojicogddingbdmcmkpbplcd) that spoofs Perplexity AI and hijacks browser search by routing Omnibox queries and real-time suggestions through a typosquatted domain (perplexity-ai.online); the extension abuses MV3 declarativeNetRequest rules and a server-side proxy (server.js) to log queries and headers, enabling data collection and user surveillance. The extension has been removed from the Chrome Store; the report includes IOCs, mitigation advice, and hunting queries for detection and response.