Malicious Firefox Extension Steals Google Account Sessions

Key Takeaways

• A malicious Firefox extension, “PDF Identity Verifier,” disguised as a legitimate PDF tool, was found to steal Google account sessions.
• The extension uses a delayed payload mechanism, retrieving its malicious code post-installation to evade initial store reviews.
• It targets active Google sessions, capable of capturing session cookies and, in some scenarios, silently resetting account passwords.
• While its user base is currently small, the attack method highlights a sophisticated evasion technique for browser extension security.
• Immediate action is required for affected users, including extension removal, Google account security review, and password changes.

Sophisticated Firefox Extension Hijacks Google Accounts

A deceptive Firefox add-on, masquerading as a utility for handling protected PDF documents, has been identified as a conduit for Google account theft. This extension covertly transforms a user’s signed-in browser into a launchpad for unauthorized access to their Google credentials.

The add-on employs a cunning strategy to circumvent detection: it initially appears benign, only fetching its malicious instructions after installation. This technique significantly reduces the suspicious code visible during automated store reviews. Named “PDF Identity Verifier” (ID: [email protected]), the extension first appeared on the Firefox Add-ons store on September 3, 2026. Its malicious capabilities were activated with version 1.4 on September 11.

The primary targets are users already authenticated into Google services. The extension is designed to seize active Google sessions and, under specific conditions, can even silently alter the account password. Security researchers at Socket.dev were instrumental in identifying this threat and meticulously detailing its post-installation attack chain in a report.

Evasion Techniques and Target Audience

In a report shared with Cyber Security News (CSN), Socket.dev said in a report that the extension’s user base is relatively small, which has limited its overall impact despite the severe risk of account takeover. The threat primarily targets users in Portuguese- and Spanish-speaking regions, luring them with the promise of a PDF identity verification tool. This incident mirrors previous cases of malicious Firefox extensions that leveraged seemingly innocuous add-ons to compromise valuable account credentials. However, this particular threat distinguishes itself by delaying the download of its harmful instructions until after it has been successfully installed.

The add-on is initially deployed without predefined targets, a clear exfiltration destination, or explicit cookie-stealing commands. Instead, its background processes are configured by settings received after installation. This modular approach makes it challenging for conventional store reviews and automated scans to detect its malicious intent.

The permissions requested by the extension—including access to storage, network requests, and Google pages—might appear legitimate for a PDF identity verification utility. It also manipulates browser passkey verification processes. While individually these permissions might not raise immediate red flags, their collective scope is critical to enabling the subsequent malicious behavior.

The Attack Chain

Approximately five seconds after installation, the extension automatically opens a webpage controlled by the attacker. This page is designed to mimic a legitimate Google-hosted service. A script embedded on this page transmits configuration settings to the newly installed extension via a message bridge. The extension then stores these settings and initiates monitoring of Google network traffic, a tactic reminiscent of other browser extensions that download their malicious payloads post-installation.

The attacker-controlled page also leverages Google’s authentic sign-in interface to identify the Google account currently active in the user’s browser. It then injects an account takeover script and redirects the victim to a genuine Google sign-in page. This method of using legitimate Google services is a deliberate choice to reduce suspicion compared to presenting a fake login portal.

Upon loading the legitimate Google page, the add-on injects its retrieved script into the victim’s browser session. A full-screen validation message is displayed to the user, effectively masking the automated steps the script performs within Google’s account recovery flow. This process includes forcing a passkey or security-key challenge and retrying actions if Google’s bot detection mechanisms intervene.

Concurrently, the extension monitors Google’s responses for session cookies. Once identified, it transmits these session cookies, along with other account details, to the attacker. It also continuously streams page content and user interactions to the attacker approximately twice per second. As other browser token leaks have demonstrated, gaining access to a live session can enable full account compromise without requiring the original password.

Account Recovery and Detection

Should Google’s security protocols trigger a password reset, the injected script is programmed to automatically generate a new password, input it, and submit the form—all while the deceptive full-screen overlay remains active. The attacker records this newly generated password, establishing a secondary access route to the account, in addition to the stolen session. This specific scenario, however, only occurs if a password reset prompt is issued by Google, meaning it is not a universal outcome of every compromise.

Socket.dev did not report a significant number of confirmed victims, assessing the overall expected impact as relatively low. The primary concern highlighted by this incident is the sophisticated method by which an external page can arm an apparently innocuous add-on after it has passed initial review processes.

What You Should Do

• For Individual Users:
  • Immediately remove the “PDF Identity Verifier” extension (ID: [email protected]) from your Firefox browser.
  • Using a trusted device (one not potentially compromised), sign out of all Google sessions.
  • Revoke all active Google tokens.
  • Change your Google account password to a strong, unique password.
  • Review your Google account security settings for any unauthorized changes to recent sign-ins, connected applications, email forwarding rules, recovery details, and authentication methods.
• For System Administrators and Organizations:
  • Block the malicious extension (ID: [email protected]) and all associated attacker infrastructure, including the C2 domain pdf[.]gusercontent[.]com and related URLs, as listed in the Indicators of Compromise below.
  • Inspect Firefox installation records and stored settings on all managed endpoints for the presence of this extension or suspicious activity.
  • Thoroughly investigate any potentially affected user accounts for signs of compromise.
  • Treat any browser profiles where this extension was installed as fully compromised, even if the files initially appeared harmless. Simply uninstalling the extension may not be sufficient to terminate ongoing account access.
  • Educate users about the risks of installing browser extensions, even those from official stores, and emphasize the importance of scrutinizing requested permissions.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.