Actor Profile

The threat actor behind this campaign remains unattributed. The operation demonstrates a financially or espionage-motivated adversary leveraging social engineering through brand impersonation of Perplexity AI, a popular search technology. The actor's infrastructure included attacker-controlled servers positioned to intercept and log user search queries and address bar inputs. Motivation likely includes credential harvesting, search query intelligence collection, or monetization through traffic manipulation. The use of the Chrome Web Store as a distribution vector indicates moderate technical capability and understanding of browser extension abuse tactics.

TTPs (Tactics, Techniques, Procedures)

The campaign employed browser extension abuse (T1176 - Browser Extensions) as the primary persistence and collection mechanism. Initial access likely leveraged social engineering (T1204.002 - User Execution: Malicious File) to convince users to install the fraudulent extension impersonating Perplexity AI. The malware performed input capture (T1056.001 - Input Capture: Keylogging) by intercepting address bar and search queries. Data exfiltration occurred via command and control (T1071.001 - Application Layer Protocol: Web Protocols) as queries were routed through attacker-controlled infrastructure before redirecting to legitimate search results to maintain operational security and avoid user suspicion. The redirection technique served dual purposes: data collection and victim deception.

Targets & Patterns

The campaign targeted users of search engines and technology platforms, specifically individuals seeking to use Perplexity AI services. The technology sector was indirectly affected through brand impersonation and potential reputational impact. Victim selection appears opportunistic rather than targeted, relying on users discovering and installing the malicious extension through the Chrome Web Store. The broad targeting suggests either intelligence collection operations seeking to harvest search behavior patterns across diverse user populations, or financially motivated activity aimed at monetizing redirected search traffic. No specific geographic targeting was identified, indicating a global victim pool. Users interested in AI-powered search tools represented the primary risk demographic.

Historical Context

Browser extension-based threats have been a persistent vector since at least 2018, with numerous campaigns leveraging the Chrome Web Store and other extension marketplaces for distribution. This campaign follows established patterns of brand impersonation seen in previous extension-based attacks targeting popular services. The technique of intercepting search queries mirrors tactics observed in adware and information stealer campaigns. Microsoft's discovery and responsible disclosure to Google, resulting in removal from the Chrome Web Store, follows standard industry coordination practices for extension-based threats. No direct links to previously documented campaigns or threat actors were established in the available reporting.

Defensive Recommendations

  • Implement browser extension allowlisting policies via enterprise management tools (Chrome Policy Management) to prevent unauthorized extension installation
  • Monitor for suspicious browser extension installations, particularly those requesting permissions to read and modify web content across all sites (T1176)
  • Deploy network monitoring to detect anomalous DNS queries and HTTP/HTTPS traffic patterns indicating query redirection through unexpected intermediary servers (T1071.001)
  • Conduct user security awareness training focused on verifying extension publishers and recognizing brand impersonation tactics before installing browser add-ons
  • Review installed browser extensions regularly for legitimacy, checking developer information and user reviews, and remove extensions with excessive permissions or suspicious behavior