T1195

Relationship Context

The extension is distributed through the Firefox Add-ons store and becomes malicious after installation. Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts

MITRE ATT&CK

T10271 shared article T10561 shared article T1059.0071 shared article T11051 shared article T11101 shared article T11851 shared article T1204.0021 shared article T15391 shared article T1552.0011 shared article

Vendors

Google1 shared article

Products

Firefox1 shared article Google Accounts1 shared article

IOC

Type	Indicator	Articles
DOMAIN	`accounts.google.com`	1
DOMAIN	`pdf.gusercontent.com`	1
SHA256	`16447c70f8e3c99de95b92846460214a661915c89f5c10965bf18da4c279880a`	1
SHA256	`dc717b5ab9a8eccf6b6187880ba90b004cb00f503ff8bceb8405ccc33d1c6e3e`	1
SHA256	`f1b8329075b1cbd1ae0a5dc947bd00f94642cb166a86c2455a1d0b10aee9f2b1`	1

Note: Related entities are extracted from article content and do not necessarily indicate impact, targeting, vulnerability, or involvement.

Threat Research · socket.dev

Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts

Socket identified a Firefox extension that appears benign when installed but retrieves attacker-controlled configuration and JavaScript afterward. The payload injects into Google…

Sep 24, 2026

Relationship Context

MITRE ATT&CK

Vendors

Products

IOC

Related Articles

Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts