Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts
Summary
Socket identified a Firefox extension that appears benign when installed but retrieves attacker-controlled configuration and JavaScript afterward. The payload injects into Google account pages, captures session cookies, and can change a victim’s password during a forced reset. Socket says the campaign targets Portuguese- and Spanish-speaking users and currently has low expected impact.
Key points
- The extension, pdf-para-texto@extensao.local, was published to the Firefox Add-ons store on September 3, 2026; malicious functionality appeared in version 1.4 on September 11.
- The shipped extension contains no hardcoded malicious logic or attacker endpoints; it is armed after installation using remote configuration.
- A message bridge and generic background dispatcher let the remote configuration register response monitoring and inject a fetched script into accounts.google.com pages.
- The extension captures Google oauth_token cookies and sends them, along with victim identifiers, to attacker infrastructure.
- The injected script automates Google sign-in steps and can set an attacker-known password if Google requires a password reset.
- Socket assesses the campaign’s current scale and expected impact as low, while noting its detection-evasion design and Portuguese- and Spanish-language targeting.
- Recommended actions include removing and blocking the extension, terminating Google sessions, resetting credentials from a trusted device, reviewing account security settings, and blocking the listed infrastructure.
Attack Vectors
- The extension is distributed through the Firefox Add-ons store and fetches its malicious configuration and payload after installation.
- The payload uses a message bridge to arm the extension, monitors Google response headers for oauth_token cookies, and injects JavaScript into accounts.google.com pages.
Defensive Notes
- Remove the extension and block its identifier through browser-management policies.
- Terminate affected Google sessions, revoke tokens, and change passwords from a trusted device; review passkeys, recovery settings, and account activity.
- Block the listed attacker infrastructure and inspect Firefox profiles for the extension and its local-storage data.
Tags
Threat ResearchMalicious Browser ExtensionAccount TakeoverCredential TheftSession HijackingSupply Chain Compromise
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | accounts[.]google[.]com | Target domain where the extension injects the account-takeover script. |
| DOMAIN | pdf[.]gusercontent[.]com | Socket identifies this as attacker-controlled C2 infrastructure. |
| SHA256 | 16447c70f8e3c99de95b92846460214a661915c89f5c10965bf18da4c279880a | Hash of the loader payload script. |
| SHA256 | dc717b5ab9a8eccf6b6187880ba90b004cb00f503ff8bceb8405ccc33d1c6e3e | Hash of the Google account-takeover payload. |
| SHA256 | f1b8329075b1cbd1ae0a5dc947bd00f94642cb166a86c2455a1d0b10aee9f2b1 | Hash of the onInstalled landing page. |
MITRE ATT&CK
T1027The extension ships generic dispatcher logic and receives its malicious behavior as runtime data.T1056The payload captures session-related data and handles password-reset input.T1059.007The remotely fetched JavaScript payload executes in the browser to automate account takeover.T1105The extension downloads remote configuration and a payload after installation.T1110The source identifies repeated authentication-flow retries and handling of passkey challenges and bot-detection pages.T1185The campaign captures and abuses the victim’s authenticated Google browser session.T1195The extension is distributed through the Firefox Add-ons store and becomes malicious after installation.T1204.002The source maps execution of attacker-supplied JavaScript inside a legitimate Google page to this technique.T1539A webRequest listener captures Google response cookies containing oauth_token and sends them to the collection endpoint.T1552.001The extension stores attacker-supplied configuration and victim identifiers in browser storage.