How can you recognize Fake Perplexity Chrome extension secretly logged your searches and IP address?

Listen to the episode

TLDR

A malicious Chrome Web Store extension called "Search for perplexity ai" impersonated the real Perplexity AI service while secretly routing every search query, autocomplete keystroke, and IP address through an attacker controlled server...

How it works

Red flags

Extension name uses odd spacing/casing mimicking a known AI brand
developer is not verified on perplexity.ai Asks for declarativeNetRequest and chrome settings overrides permissions, unnecessary for an AI search wrapper Routes traffic through a typosquatted domain (perplexity ai[.]online) instead of the official site

What to do

1Open chrome://extensions/ , enable Developer mode, and remove "Search for perplexity ai" immediately Compare each extension's 32 character ID against the publish

Source

malwarebytes

Source reviewed by Mythos Forensic Team

https://www.malwarebytes.com/blog/privacy/2026/07/fake-perplexity-chrome-extension-spies-on-your-searches

FAQ

Is Fake Perplexity Chrome extension secretly logged your searches and IP address a real scam pattern?

Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.

What are the first warning signs?

Extension name uses odd spacing/casing mimicking a known AI brand; developer is not verified on perplexity.ai Asks for declarativeNetRequest and chrome settings overrides permissions, unnecessary for an AI search wrapper Routes traffic through a typosquatted domain (perplexity ai[.]online) instead of the official site

What should I do first?

Open chrome://extensions/ , enable Developer mode, and remove "Search for perplexity ai" immediately Compare each extension's 32 character ID against the publish

Can LegalAudit check my case?

Yes. Start a free chat and paste the message, link, sender, or payment details for triage.