Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts

A malicious Firefox extension named '[email protected]' poses as a PDF identity verifier to target Portuguese- and Spanish-speaking users, enabling automated Google account takeover. The extension avoids static detection by shipping without hardcoded malicious code and instead fetches its payload post-installation from attacker-controlled infrastructure. It steals Google session cookies (oauth_token) and can silently reset passwords during Google's sign-in flow, providing attackers with both immediate and persistent access. The malicious behavior is triggered after installation via a lookalike domain (pdf[.]gusercontent[.]com), which delivers configuration data that arms the extension with credential-theft and automation capabilities.

AI-extracted · verify before operational use