Chromium extension uses AI‑related branding to redirect browser search

This collection of Microsoft Security Blog posts describes multiple active and emerging threats as well as defensive guidance. Key incidents include a malicious Chromium extension spoofing Perplexity AI that uses Manifest V3 APIs and intermediary infrastructure to redirect browser search traffic; a multi-stage Photo ZIP campaign targeting hospitality organizations in Europe and Asia that delivers a persistent Node.js implant via fake image shortcut files; a Mastra npm supply‑chain compromise (Sapphire Sleet) that delivered a postinstall payload affecting 140+ projects; and a technical takedown