Context: The Extension That Looked Like AI

According to a report from The Hacker News, Microsoft discovered a malicious Chrome extension that pretended to be the AI search tool Perplexity. The extension quietly logged every search query and every character typed into the browser’s address bar. It sent that data to an attacker-controlled server before showing the user normal-looking results. Google removed the extension from the Chrome Web Store after being notified.

This matters because the extension used a trusted AI brand to gain credibility. The operators created a look-alike domain and gave the extension a name that seemed official. For many users, the promise of “AI-powered search” was enough to install it without checking the publisher or the permissions it asked for. The real danger wasn’t a flashy pop-up or a crash — it was a silent, invisible collector of everything you typed.

Why This Attack Worked So Well

The clever part of this attack was how it redirected traffic. The extension changed the browser’s default search engine and also took control of the live suggestion feature. That means every character you typed in the address bar — before you even pressed Enter — was sent to the attacker’s server. The user saw normal results, so nothing looked wrong.

The extension asked for permissions that let it rewrite and redirect network requests. That kind of access is unusual for a search tool and should have been a red flag. But because Chrome allows search-provider overrides, the extension appeared to be doing something legitimate. The AI brand gave it an extra layer of trust. Attackers are now using the hype around artificial intelligence to trick people into installing what are essentially spy tools.

What This Means for Australian SMBs

Small and mid-sized businesses in Australia often rely on browser extensions for productivity, research, and communication. An employee installing a fake AI search tool on a work computer can expose company data — client names, project details, internal terms — through every search query. That data leaves the network before anyone notices.

Many SMBs do not have strict policies about which browser extensions are allowed. Even a single compromised extension can give attackers a window into your team’s daily activities. The fact that this extension posed as a popular AI service makes it even harder for busy employees to spot the risk. For Australian businesses, this is a reminder that new technology often comes with new attack surfaces.

What You Can Do Now

  • Audit all browser extensions currently installed on company devices. Remove any that you do not recognise or that request permissions like “read and change all your data on websites.”
  • Use browser management policies to block users from installing extensions from outside an approved list. For Chrome, you can set this via group policy or a cloud management console.
  • Train staff to verify the publisher and domain name before installing any AI-branded tool. Real services like perplexity.ai use official domains, not look-alikes with dashes or extra words.
  • Monitor for unexpected changes to default search engines or address bar settings. A sudden switch to a new search provider can be a sign of malicious activity.
  • Deploy endpoint detection tools that flag unusual network traffic — especially requests to unfamiliar domains right after a search is made.

At MS&VG, we help Australian SMBs identify these hidden threats and put practical defences in place. If you are unsure whether your team’s browser extensions are safe, a quick audit can save you from becoming the next headline.