Security researchers at Socket said the add-on, identified as PDF Identity Verifier and carrying the extension ID pdf-para-texto@extensao. local, was published on Mozilla’s Firefox Add-ons store on September 3. Malicious functionality appeared in version 1.4 on September 11, while the campaign was primarily tailored to Portuguese- and Spanish-speaking users.
The technique stands out because the extension package itself contained no hardcoded credential-stealing logic, target addresses or data-exfiltration endpoint. Instead, its harmful instructions were fetched from attacker-controlled infrastructure after installation, making routine static inspection less likely to expose the eventual account-takeover behaviour.
Five seconds after installation, the extension opened a page on pdf. gusercontent. com, a domain designed to resemble Google’s legitimate googleusercontent. com service. Code loaded from that site supplied configuration data and a second-stage script, which the add-on stored locally and later injected into genuine accounts. google. com pages visited by the user.
Socket’s analysis found that the extension used Google’s Federated Credential Management interface to identify the Google account already signed into the browser. It then redirected the victim into Google’s legitimate account flow while an injected script operated behind an overlay displaying an identity-validation message.
The malware attempted to bypass the normal password stage and steer the account through passkey or security-key challenges. At the same time, a Firefox web-request listener watched responses from Google domains for a Set-Cookie header containing an oauth_token value. Once detected, the session cookie was sent to the attacker’s collection server along with identifiers linked to the victim.
A valid session cookie can give an attacker access to an already authenticated account without first learning the password, depending on the session’s validity and Google’s security checks. That mechanism explains why the campaign could begin with account access rather than conventional password theft.
Researchers also found a second route to persistence. If Google’s security process required a password reset during the automated flow, the injected script generated a new password, entered it into the legitimate Google form and submitted the change. The attacker’s infrastructure then received the newly set value, potentially providing both an active session and a password controlled by the operator.
The script additionally transmitted page text and information about interactive elements to the attacker at short intervals, giving the operator visibility into the takeover process. Socket said this telemetry could help the malware react to account prompts, security checks and changes in the page displayed to the victim.
The campaign appears limited in scale. The research did not establish who operated infrastructure, how victims were directed to the listing, or whether Mozilla had removed it. Socket said the extension did not have a significant user base and assessed the expected impact as fairly low. A third-party tracker recorded 11 daily users as of September 17, although that figure does not establish how many installations were compromised or whether every user encountered the malicious version.
The case nevertheless highlights a weakness in relying solely on static review of browser-extension packages. The submitted files acted largely as a dispatcher, while the instructions defining what network traffic to inspect, what code to inject and where to send captured data arrived only after installation.
Mozilla introduced additional disclosure requirements for newly submitted Firefox extensions in November 2025, requiring developers to specify whether their add-ons collect or transmit personal data. Those declarations are displayed during installation and on the add-on’s permissions information, but they do not by themselves prevent an extension from changing behaviour through remotely supplied instructions.
Socket advised organisations to remove PDF Identity Verifier, block its extension identifier through browser-management policies and inspect Firefox profiles for installation records or stored configuration data. It also recommended blocking the attacker-controlled pdf. gusercontent. com domain and treating affected browser profiles as compromised.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
