A malicious Firefox extension masquerading as a PDF identity-verification utility has been found targeting Google accounts through session-cookie theft and automated account-takeover activity.
The campaign is notable because the add-on initially contains no obvious credential-stealing code, malicious URLs, or hardcoded payloads, allowing it to appear benign during basic static analysis.
Malicious functionality was introduced in version 1.4 on September 11.
Although the extension reportedly has no substantial user base and the immediate impact is assessed as low, its post-install arming mechanism demonstrates a detection-evasion method that browser-extension security teams should monitor closely.
The add-on presents itself as a tool that validates a user’s identity before protected PDF documents can be opened.
Its packaged files manifest.json, content.js, and background.js do not include overtly malicious account-hijacking logic.
Instead, the background worker functions as a generic command interpreter.
It reads an initially empty configuration object from browser.storage.local and can resolve and invoke browser APIs based on attacker-supplied strings. In effect, the malicious behavior is stored as configuration data rather than embedded code.
This distinction matters. A reviewer inspecting the submitted extension sees no fixed collection server, no Google login payload, and no explicit cookie-theft routine.
The extension becomes operational only after installation, when it retrieves a configuration and payload from attacker-controlled infrastructure.
The installed add-on opens pdf[.]gusercontent[.]com/oninstalled after a five-second delay. The domain imitates Google’s legitimate googleusercontent.com domain but is controlled by the attacker.
A script on this landing page communicates with the extension through an exposed window.postMessage bridge and writes the operational configuration into local extension storage.
Mozilla’s extension policies state that add-ons must be self-contained, reviewable, and must not load remotely hosted code for execution.
Mozilla also warns developers against remote-script injection because code can change without users’ or reviewers’ knowledge.
After receiving attacker-controlled configuration, the extension monitors responses from https://*.google.com/*.
It specifically searches Set-Cookie response headers for values containing oauth_token, then sends the captured cookie data, encoded victim email, and campaign identifier to the attacker’s collection endpoint.
That enables session hijacking without first obtaining a password. A valid authenticated session cookie can allow an attacker to access an account session as the victim, depending on the service’s session protections and risk checks.
Google has identified stolen cookies as a post-authentication threat and has been developing Device Bound Session Credentials to make stolen sessions harder to reuse from another device.
Socket’s Threat Research team identified the extension, as [email protected], which was published on the Firefox Add-ons store on September 3, 2026.
Fake Firefox Extension
The campaign also injects a second-stage script into legitimate accounts.google.com pages. It first calls Google’s real Federated Credential Management API to identify the signed-in account, then redirects the victim into an authentic Google sign-in flow.
Once the Google account page loads, the extension injects attacker-hosted automation into the victim’s real Google domain session.
The payload displays a full-screen “Validating your identity” overlay, concealing the actions occurring behind it.
It then attempts to drive Google’s authentication and account-recovery workflow, including passkey or security-key challenges.
If Google’s risk controls require a password reset, the script generates and submits a new password, giving the operator an additional durable access path.
The extension uses two concurrent takeover mechanisms: stolen oauth_token session cookies for immediate access, and attacker-controlled replacement passwords when a reset is triggered.
It also sends live page text and interactive-element data to the operator at frequent intervals, providing real-time visibility into the automated takeover process.
Organizations should hunt for requests to pdf[.]gusercontent[.]com, review Firefox installations for the [email protected] identifier, and investigate suspicious OAuth session activity.
The threat is particularly concerning because it abuses trusted Google pages rather than relying solely on a cloned phishing portal.
The extension’s user-facing lures and PDF-verification content support Portuguese, European Portuguese, Spanish, and English, with Portuguese-language wording suggesting a focus on Portuguese- and Spanish-speaking victims.
Passkeys can reduce exposure to conventional password phishing because they are device-bound credentials that cannot simply be typed into a fraudulent site.
However, this campaign shows that passkeys alone do not eliminate threats from malicious browser extensions operating inside an authenticated browser session.
Users should remove the extension immediately if installed, revoke unfamiliar browser add-on permissions, change their Google password from a clean device, review active sessions in Google Account security settings, and sign out of unrecognized devices.
Security teams should treat extensions requesting broad webRequest, storage, Google-domain access, and document-start content-script privileges as high-risk combinations, particularly when the extension’s business function does not clearly require them.
IOCs
| Category | Indicator / Artifact | Details | SHA-256 |
|---|---|---|---|
| C2 infrastructure | pdf[.]gusercontent[.]com | Command-and-control domain used by the campaign | — |
| Landing page | pdf[.]gusercontent[.]com/oninstalled | onInstalled landing page associated with the malicious infrastructure | f1b8329075b1cbd1ae0a5dc947bd00f94642cb166a86c2455a1d0b10aee9f2b1 |
| Loader payload | pdf[.]gusercontent[.]com/loginSdk/assets/index-BhOgWOaO.js | JavaScript loader payload script | 16447c70f8e3c99de95b92846460214a661915c89f5c10965bf18da4c279880a |
| Account-takeover payload | Google account takeover payload | Final-stage malicious payload used to facilitate Google account takeover activity | dc717b5ab9a8eccf6b6187880ba90b004cb00f503ff8bceb8405ccc33d1c6e3e |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
