Malicious Firefox Extension Disguised as PDF Tool Steals Google Account Sessions

A Firefox add-on posing as a tool for opening protected PDF documents can quietly turn a signed-in browser into a route to Google account theft.

It waits until installation to obtain the instructions that make it dangerous, leaving little suspicious code for store reviewers. The extension appeared in the Firefox Add-ons store on September 3, 2026. Version 1.4 turned malicious on September 11.

It targets people already using Google services, where it can capture an active session and, under certain conditions, change the account password silently. Analysts at Socket.dev identified the extension and traced its post-installation attack.

Socket.dev said in a report shared with Cyber Security News (CSN) that the add-on has a small user base, limiting its reach despite the account takeover risk.

The lure is aimed mainly at Portuguese- and Spanish-speaking users, under a PDF identity-check pretext. The case echoes earlier malicious Firefox extensions that misused ordinary-looking add-ons to reach valuable account credentials, but this one hides its instructions until installation.

Malicious Firefox Extension Steals Google Sessions

The add-on ships without fixed targets, a theft destination or explicit cookie-stealing instructions. Instead, its background component acts on settings supplied later. That separation can frustrate store reviews and simple scans.

Its requested access includes storage, network requests and Google pages, permissions that may seem plausible for an identity-check tool. It also alters browser passkey checks. Alone, these clues do not prove an attack, but together they explain why its later behavior matters.

Five seconds after installation, it opens an attacker page resembling a Google-hosted service. A script on that page sends settings through a message bridge into the extension, which stores them and starts monitoring Google traffic. This echoes browser extensions downloading payloads after installation.

The page also uses Google’s genuine sign-in interface to identify the account already active in the browser. It supplies an account takeover script, then sends the victim to a real Google sign-in page. Using the legitimate service can look less suspicious than a fake login page.

When that page opens, the add-on injects its fetched script into the victim’s browser session. A full-screen validation message hides automated steps through Google’s real account flow. It forces a passkey or security-key challenge and retries after bot-detection blocks.

In parallel, the extension watches Google responses for a session cookie and sends a matching value to the attacker with account details. It also streams page text and controls about twice a second. As another browser token leak illustrates, access to a live session can expose accounts without their original passwords.

Account Recovery and Detection

If Google’s own checks require a password reset, the script generates a new password, enters it and submits the form while the overlay stays on screen.

The attacker records it, gaining a second access path alongside the stolen session. That requires a reset prompt; it does not happen in every case.

Socket did not report a large confirmed victim count. It assessed the expected overall impact as fairly low. The concern is how an outside page arms an apparently clean add-on after review. Investigators should also review account security events for unexpected password resets or recovery changes.

The injected script tries to conceal its work with a verification screen, so the absence of a visible login prompt does not rule out an attempted takeover. Network records can help identify contact with attacker infrastructure.

Anyone who installed the add-on should remove it, then use a trusted device to sign out of Google sessions, revoke active tokens and change the account password.

Users should also inspect recent sign-ins, connected apps, forwarding rules, recovery details and authentication methods for changes. Past PDF themed extension attacks show why a document-related name is not evidence that an add-on is safe.

Administrators should block the extension and attacker infrastructure, inspect Firefox installation records and stored settings, and investigate affected accounts. Treat affected browser profiles as compromised despite harmless-looking files. Uninstalling alone may not end account access.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Firefox extension ID	pdf-para-texto@extensao.local	PDF Identity Verifier add-on.
C2 domain	pdf[.]gusercontent[.]com	Attacker-controlled domain.
URL	pdf[.]gusercontent[.]com/oninstalled	Post-installation landing page.
URL	pdf[.]gusercontent[.]com/loginSdk/assets/index-BhOgWOaO.js	Loader payload script.
URL	pdf[.]gusercontent[.]com/loginSdk/load-addon.js	Google account takeover payload.
URL	pdf[.]gusercontent[.]com/api/accounts/collect/?leadId=&email=&data=	Token exfiltration endpoint.
URL	pdf[.]gusercontent[.]com/api/extlog	Live session telemetry endpoint.
URL	pdf[.]gusercontent[.]com/reload	Post-hijack redirect.
SHA-256	f1b8329075b1cbd1ae0a5dc947bd00f94642cb166a86c2455a1d0b10aee9f2b1	Post-installation landing page.
SHA-256	16447c70f8e3c99de95b92846460214a661915c89f5c10965bf18da4c279880a	Loader payload script.
SHA-256	dc717b5ab9a8eccf6b6187880ba90b004cb00f503ff8bceb8405ccc33d1c6e3e	Google account takeover payload.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC