Eight Malicious Firefox Extensions Expose Users to Credential Theft and Surveillance

The Socket Threat Research Team recently discovered a troubling network of malicious Firefox browser extensions that pose serious threats to user security and privacy.

Initially focusing on a single extension, “Shell Shockers,” which redirected users to tech support scam sites, the probe expanded to reveal a coordinated campaign by threat actor “mre1903.”

This actor, active since June 2018, has orchestrated a series of fake gaming extensions mimicking popular titles like “Little Alchemy 2,” “1v1.LOL,” “Krunker io Game,” “Five Nights at Freddy’s,” and “Bubble Spinner.”

Deceptive Gaming Extensions

Far from delivering gaming functionality, these extensions redirect unsuspecting users to gambling sites and fraudulent Apple virus alert pages with fabricated error codes like “0x800VDS.”

Their use of familiar game names exploits user trust, making the social engineering tactic particularly effective, while immediate popup windows upon installation catch users off-guard, heightening vulnerability to scams designed to extract personal data and payments.

Beyond the gaming facade, the investigation exposed unrelated malicious extensions with even more invasive capabilities.

“GimmeGimme,” marketed as a wishlist tool for European e-commerce platforms like bol.com and coolblue.nl, secretly hijacks user sessions through affiliate tracking links, generating illicit revenue for attackers while offering no promised functionality.

Its redirect infrastructure poses a latent threat, easily adaptable for credential harvesting or malware distribution.

Escalating Threats Beyond Gaming

Similarly, “VPN Grab A Proxy Free” masquerades as a privacy tool but injects invisible tracking iframes and routes all traffic through attacker-controlled HTTP proxies, enabling comprehensive surveillance of sensitive data, including login credentials and personal communications, while downgrading secure HTTPS connections to facilitate man-in-the-middle attacks.

Most alarmingly, “CalSyncMaster” poses as a Google Calendar synchronization tool but executes sophisticated OAuth credential theft, exfiltrating access tokens to a remote server.

Even with read-only scope, this allows persistent access to sensitive calendar data, enabling potential espionage or social engineering.

A simple update could escalate permissions to write access, amplifying the threat to data integrity and user security.

According to the Report, These findings underscore a broader trend across browser ecosystems malicious extensions are evolving from mere annoyances like adware to advanced threats capable of sustained, undetected exploitation.

This alarming spectrum of malicious behavior, spanning from deceptive redirects to outright credential theft, highlights the urgent need for vigilance in the browser extension ecosystem.

Users are strongly advised to audit installed extensions, scrutinize permissions, and monitor network traffic for anomalies. Organizations should enforce allow-lists to curb unauthorized installations.

As browser extensions continue to be exploited due to their trusted status and extensive access within browser security contexts, the combination of social engineering and technical sophistication in these threats demands proactive defense measures to safeguard personal and organizational data against this escalating attack vector.

Indicators of Compromise (IOCs)

Type	Indicator
Malicious Domains	funformathgame[.]com
	polar-shore-05125-b49ae913d73c[.]herokuapp[.]com
Malicious Extensions	CalSyncMaster
	VPN – Grab a Proxy – Free
	GimmeGimme
	Five Nights at Freddy’s
	Little Alchemy 2
	Bubble Spinner
	1v1.LOL
	Krunker io Game
Threat Actor	mre1903

Exclusive Webinar Alert: Harnessing Intel® Processor Innovations for Advanced API Security – Register for Free