Fake Firefox add-on targets Google sessions for takeover

A malicious Firefox extension, masquerading as a PDF identity verification tool, was discovered to compromise Google accounts. This extension, labeled "PDF Identity Verifier" with the extension ID "pdf-para-texto@extensao.local," was uploaded to Mozilla's Firefox Add-ons store on September 3. Its malicious capabilities became apparent with version 1.4, released on September 11.

The attack primarily targeted Portuguese and Spanish-speaking users. The extension's malicious instructions were fetched from attacker-controlled servers following installation, making traditional static analysis ineffective. Within five seconds of installation, the extension directed users to a page resembling Google's legitimate service.

This page loaded code that stored configuration data and a second-stage script, which the extension later injected into the user's accounts. By utilizing Google's Federated Credential Management interface, the extension identified the already signed-in Google account and redirected the user into the legitimate account verification process while an overlay simulated an identity validation message.

The extension attempted to bypass password stages and circumvent security measures, such as passkey or security-key challenges. Simultaneously, a Firefox web-request listener monitored responses from Google domains for a Set-Cookie header containing an oauth_token value. Upon detection, the session cookie was sent to the attacker's server, along with identifiers linked to the victim.

This cookie could grant unauthorized access to the authenticated account, depending on its validity and Google's security measures. The extension also provided a second method of persistence. If Google's security process necessitated a password reset during the automated flow, the injected script generated a new password, entered it into the legitimate Google form, and submitted the change.

The attacker's infrastructure received the new password value, potentially granting them access to both the active session and the password-controlled account. The extension's telemetry provided the attacker with visibility into the takeover process. The campaign's scale was limited, with only 11 daily users recorded as of September 17.

However, the incident underscores the importance of relying on more than just static reviews of browser extension packages, as the malicious instructions arrived only after installation, potentially altering the extension's behavior. Mozilla introduced enhanced disclosure requirements for Firefox extensions in November 2025, mandating developers to disclose whether their add-ons collect or transmit personal data.

Despite these measures, malicious extensions can still change their behavior through remotely supplied instructions. Experts recommend removing PDF Identity Verifier, blocking its extension identifier using browser management policies, inspecting Firefox profiles for installation records or stored configuration data, and blocking the attacker-controlled pdf.gusercontent.com domain.