Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts

MITRE Techniques

• [T1195 ] Supply Chain Compromise – The extension is delivered through the Firefox Add-ons store and only becomes malicious after installation, abusing trusted software distribution (‘published to the Firefox Add-ons store’ and ‘the extension fetches its malicious configuration and payload from attacker infrastructure only after installation’).
• [T1056 ] Input Capture – The script intercepts and manipulates authentication-related inputs, including password-reset handling and session-related data (‘capturing both the victim’s Google session cookie and, when Google prompts for one, a password reset value’).
• [T1110 ] Brute Force – The takeover flow repeatedly retries and drives Google authentication steps, including password-reset and passkey challenge handling (‘forcing the passkey/security-key challenge’ and ‘detecting and retrying around Google’s own bot-detection block page’).
• [T1552.001 ] Credentials in Files – The extension stores attacker-controlled configuration and victim identifiers in browser storage for later use (‘browser.storage.local.set’ and ‘stores {leadId, email} into the config object’).
• [T1204.002 ] Malicious File Execution – The operator injects and executes attacker-supplied JavaScript inside a legitimate Google page (‘browser.tabs.executeScript’ and ‘injects the fetched load-addon.js directly into that real Google page’).
• [T1059.007 ] JavaScript – The payload is executed as JavaScript in the browser context to automate account takeover (‘load-addon.js’ and ‘script that will later be injected into accounts.google.com tabs’).
• [T1027 ] Obfuscated Files or Information – The extension avoids detection by shipping generic dispatcher logic and receiving malicious behavior only as data (‘contains no hardcoded malicious logic’ and ‘The malicious behavior … is data, not code’).
• [T1105 ] Ingress Tool Transfer – The extension downloads a remote payload and configuration after installation (‘fetches its malicious configuration and payload from attacker infrastructure’).
• [T1539 ] Steal Web Session Cookie – The webRequest listener captures Google session cookies from responses and exfiltrates them (‘watches all https://*.google.com/* responses for a Set-Cookie header containing oauth_token’).
• [T1185 ] Browser Session Hijacking – The campaign captures the victim’s authenticated Google session and uses it to gain account access (‘stolen, valid oauth_token session cookie’ and ‘turns the victim’s own authenticated browser session into a remote-controlled account-takeover bot’).