Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts
Socket identified a Firefox extension that appears benign when installed but retrieves attacker-controlled configuration and JavaScript afterward. The payload injects into Google…