Fake Perplexity Chrome Extension Intercepts Search Traffic
Perplexity’s growing profile as an artificial intelligence search service has made its brand a target for impersonation. A malicious Chromium extension posing as an official Perplexity tool was designed to intercept users’ search traffic and collect sensitive data, including IP addresses and HTTP headers. The activity raises privacy and cybersecurity concerns because browser extensions can gain broad access to browsing sessions while appearing legitimate to consumers and corporate users.
Microsoft identified and reported the malicious extension, after which Google said it had removed the software. However, researchers still found it listed in the Chrome Web Store as of the report’s publication, suggesting the takedown had not been fully enforced. The extension had accumulated more than 10,000 installations, leaving a sizable pool of potentially affected users who may need to disable and delete it and review browser and account security.
All Coverage
1 original reportsThe Backstory
The history behind this eventMalicious PromptSnatcher Browser Extensions Steal Users’ AI Conversations
Browser extensions can read webpage content and inject code, giving them potential access to corporate secrets, personal data and unpublished ideas if those permissions are abused. By targeting generative AI services including ChatGPT, Gemini and Claude, PromptSnatcher shows how users who install seemingly legitimate ad blockers may expose their full conversations and paid subscription status.
The MalExt Sentry cybersecurity project recently uncovered PromptSnatcher and identified a malicious engine embedded in two ad-blocking extensions with nearly 90,000 installations combined. The software continuously monitors eight major AI platforms, collects user prompts, model responses and subscription information, and sends the data to a remote server controlled by the attackers. Publicly available information does not specify the exact disclosure date.
Subscribe to Mark Radar Weekly
Every Friday, the week's strongest signals in your inbox. Unsubscribe anytime.
If you search news on Google, you can set Mark Radar as a preferred source—our coverage will show up more often in your results. Set as preferred source on Google →