Reported by 3 outlets
Fake Firefox Extension Hijacks Google Accounts Without Stealing Passwords First
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.57 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
A Firefox extension named PDF Identity Verifier appeared in the Firefox Add-ons store on September 3 and introduced malicious functionality in version 1.4 on September 11. Socket's Threat Research team found the extension has a small user base and low expected impact, but its design is notable: the submitted files contain no hardcoded theft routine, Google account target, or exfiltration address. Those instructions are delivered after installation via an attacker-controlled lookalike domain, pdf.gusercontent.com/oninstalled. The extension then uses the Federated Credential Management API to identify a signed-in account, obtains session cookies, and automates account takeover. Users should remove the extension, review installed add-ons, and avoid identity-verification tools from unverified publishers.
Timeline
-
original reporting
Fake Firefox Extension Hijacks Google Accounts Without Stealing Passwords First
gbhackers.com · 19d ago · September 24th, 2026
A malicious Firefox extension masquerading as a PDF identity-verification utility has been found targeting Google accounts through session-cookie theft and automated account-takeover activity. The campaign is notable because the add-on initially contains no obvious credential-stealing code, malicious URLs, or hardcoded payloads, allowing it to appear benign during basic static analysis. Malicious functionality was introduced in […] The post Fake Firefox Extension Hijacks Google Accounts Without Stealing Passwords First appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Firefox Extension Uses OAuth Session Cookie Theft to Hijack Google Accounts
cyberpress.org · 19d ago · September 24th, 2026
A Firefox extension disguised as a PDF identity-verification tool can steal Google session cookies and automate account takeover, according to Socket’s Threat Research team. The add-on, called PDF Identity Verifier, appeared in the Firefox Add-ons store on September 3, 2026. Socket says the extension has a small user base, so its expected impact is low. The case is notable for its design, the files submitted to the store contain no hardcoded theft routine, Google account target , or exfiltration address. The extension receives those instructions only after installation. When installed, the extension waits five seconds before opening pdf[.]gusercontent[.]com/oninstalled . This is an attacker-controlled lookalike domain, not Google’s legitimate googleusercontent.com . A script on the page sends configuration data to the extension through a message bridge in its content script. Firefox Extension Hijacks Google Accounts The background script stores that data in browser.storage.local . It then uses the supplied strings to register a network-response listener and choose which code to inject into a browser tab. In effect, the extension’s dangerous behavior is assembled at runtime rather than being visible as a complete routine in the submitted files. The landing-page script also uses Google’s Federated Credential Management API to identify a signed-in account. It obtains the victim’s email and an identifier,
-
update from socket.dev
(socket.dev) Sophisticated Firefox Extension Evades Detection to Hijack Google Accounts via Post-Install Payload Delivery In brief - This ar
socket.dev · 19d ago · September 24th, 2026
(socket.dev) Sophisticated Firefox Extension Evades Detection to Hijack Google Accounts via Post-Install Payload Delivery In brief - This ar
via Mastodon https://socket.dev/blog/firefox-google-account-takeover