Google removed a malicious Chromium-based browser extension masquerading as Perplexity AI after Microsoft Threat Intelligence identified it was intercepting users’ search traffic and routing queries through attacker-controlled servers before forwarding them to legitimate search engines. Microsoft said the extension’s primary objective was search traffic interception and data collection, which might enable downstream use cases such as profiling, targeted advertising, or other forms of misuse. The extension abused Chromium’s Manifest V3 APIs to intercept searches entered through the browser’s address bar, forwarding those queries through intermediary infrastructure controlled by the attacker while redirecting users to legitimate search providers, making the activity difficult to detect. Microsoft reported the extension to Google, which subsequently removed it. The incident reflects a broader trend of attackers increasingly abusing the names and branding of popular AI platforms in phishing and malware campaigns.