Loading story…
A malicious Firefox add-on named PDF Identity Verifier masqueraded as a protected-PDF or identity-verification tool to target signed-in Google users, primarily through Portuguese- and Spanish-language lures. Initially listed in the Firefox Add-ons store, the extension later retrieved its operational configuration and account-takeover scripts from attacker-controlled infrastructure after installation, limiting the malicious code visible during static store review.
The add-on injected remote scripts into legitimate Google sign-in flows, collected session-cookie-related data, account details, and live page telemetry, then exfiltrated them to attacker infrastructure. When Google triggered a password reset, it could silently set and steal a new password, allowing persistent account takeover. Although Socket.dev observed a small user base and no large confirmed victim count, affected users should remove the extension, revoke Google sessions and tokens from a trusted device, reset passwords, and review account-security settings for unauthorized changes.
Trace attribution and downstream blast radius.
3 events from the most recent confirmed update back to the earliest known activity.
Version 1.4 began retrieving attacker-supplied configuration and takeover scripts after installation, enabling monitoring of Google traffic and theft of active Google-session data. The campaign used Portuguese- and Spanish-language PDF identity-check lures and could also set and exfiltrate a new password when a Google reset prompt appeared.
The Firefox extension PDF Identity Verifier (pdf-para-texto@extensao.local), presented as a protected-PDF or identity-verification tool, appeared in the Firefox Add-ons store.
Socket.dev identified the PDF Identity Verifier campaign and documented its post-installation delivery of remote Google-account takeover scripts, session-data exfiltration, and live page telemetry to attacker-controlled infrastructure. It reported a small observed user base and no large confirmed victim count.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malicious campaign known as GhostPoster has been discovered leveraging the logo files of 17 Mozilla Firefox browser add-ons to conceal JavaScript code that enables a range of fraudulent activities. These extensions, which were collectively downloaded over 50,000 times, posed as legitimate tools such as VPNs, ad blockers, screenshot utilities, and translation services. Security researchers from Koi Security found that the malicious code was hidden within the image files using steganography, allowing it to evade detection. Once activated, the code would hijack affiliate links, inject tracking scripts, and facilitate click and ad fraud, while also stripping away browser security protections and opening a backdoor for remote code execution. The attack chain is initiated when the extension loads and fetches its logo file, which is parsed for a specific marker to extract the embedded JavaScript loader. This loader then attempts to retrieve the main malware payload from attacker-controlled domains, but only does so 10% of the time and with a 48-hour delay between attempts, making detection more difficult. The extensions have since been removed from the Firefox add-on store, but the campaign highlights the risks of malicious browser extensions and the sophisticated evasion techniques employed by threat actors. All identified extensions communicated with the same malicious infrastructure, and not all used identical payload delivery methods, but they shared the same core behaviors and objectives.
Jun 29, 2026
Researchers reported multiple **malicious browser extension** campaigns abusing official add-on ecosystems to steal data and hijack accounts. One operation tracked as **GhostPoster** hid malicious logic inside seemingly benign PNG image files, a technique used to evade typical extension review and static checks; follow-on infrastructure analysis linked the activity to at least **17 additional extensions** using the same backend and tactics, with **~840,000 installs** and some extensions active for up to **five years**. The campaign reportedly started on **Microsoft Edge** and later expanded to **Chrome and Firefox**, emphasizing stealth and long-term persistence over rapid spread. Separately, Socket researchers identified **five malicious Chrome extensions** impersonating enterprise platforms (*Workday, NetSuite, SuccessFactors*) to enable **session hijacking and account takeover**. The extensions were described as working together to **steal authentication tokens/cookies**, **block incident response** by manipulating the DOM to interfere with security administration pages, and perform **cookie injection** to take over sessions; most were removed from the Chrome Web Store but remained available via third-party download sites. In response to the broader extension abuse, **Mozilla and Microsoft** removed identified add-ons from their marketplaces, but already-installed extensions remain a risk and require **manual removal**.
Jun 29, 2026
Attackers compromised several legitimate Chrome extensions by phishing developers’ Google Account credentials and then using those accounts to push malicious updates through the Chrome Web Store. Proofpoint reported that affected extensions included **Web Developer** (`0.4.9`), **Chrometana**, **Infinity New Tab**, **CopyFish**, **Web Paint**, and **Social Fixer**, with **TouchVPN** and **Betternet VPN** also likely impacted. Because the updates came from trusted publisher accounts, the malicious code was delivered to existing users as if it were a normal extension release. The injected code delayed execution after installation, retrieved additional payloads from **DGA-generated domains**, and then manipulated browser activity to hijack traffic, replace advertisements, display fake repair alerts, and redirect victims to affiliate programs. Researchers also identified credential-theft components in the campaign, including scripts intended to steal and exfiltrate **Cloudflare** credentials, showing that the operation combined ad fraud, traffic interception, and account compromise in a broad extension hijacking spree.
Aug 14, 2026