Malicious Firefox Extension Disguised as PDF Tool Steals Google Account Sessions
A Firefox PDF add-on fetches post-install instructions that steal Google sessions and can silently reset passwords.
Socket identified a Firefox add-on, PDF Identity Verifier (pdf-para-texto@extensao.local), listed on September 3, 2026, that became malicious in version 1.4 on September 11. After installation it loads attacker-supplied settings, monitors Google traffic, exfiltrates session cookies, and can submit a new password when Google requires a reset, hidden by a full-screen overlay. The lure mainly targets Portuguese- and Spanish-speaking users with a protected-PDF pretext. Socket reported a small user base and assessed overall impact as fairly low.
- PDF Identity Verifier appeared September 3 and turned malicious in version 1.4 on September 11.
- After install it fetches remote instructions, steals Google session cookies, and can reset passwords.
- A full-screen overlay hides automated steps on Google's real sign-in flow.
- Socket says the user base is small and expected impact is fairly low.
- Defanged C2 domain is pdf.gusercontent.com; remove the add-on and revoke sessions.
- ATT&CK
- T1176 Browser ExtensionsT1539 Steal Web Session CookieT1185 Browser Session HijackingT1098 Account Manipulation
- Products
- Firefox
- Malware
- PDF Identity Verifier
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | pdf.gusercontent.com | exto@extensao.local PDF Identity Verifier add-on. C2 domain pdf[.]gusercontent[.]com Attacker-controlled domain. URL pdf[.]gusercontent[.]co |
| sha256 | 16447c70f8e3c99de95b92846460214a661915c89f5c10965bf18da4c279880a | 2455a1d0b10aee9f2b1 Post-installation landing page. SHA-256 16447c70f8e3c99de95b92846460214a661915c89f5c10965bf18da4c279880a Loader payload script. SHA-256 dc717b5ab9a8eccf6b6187880ba9 |
| sha256 | dc717b5ab9a8eccf6b6187880ba90b004cb00f503ff8bceb8405ccc33d1c6e3e | 15c89f5c10965bf18da4c279880a Loader payload script. SHA-256 dc717b5ab9a8eccf6b6187880ba90b004cb00f503ff8bceb8405ccc33d1c6e3e Google account takeover payload. Note: IP addresses and dom |
| sha256 | f1b8329075b1cbd1ae0a5dc947bd00f94642cb166a86c2455a1d0b10aee9f2b1 | f[.]gusercontent[.]com/reload Post-hijack redirect. SHA-256 f1b8329075b1cbd1ae0a5dc947bd00f94642cb166a86c2455a1d0b10aee9f2b1 Post-installation landing page. SHA-256 16447c70f8e3c99de95 |
From the original article
4 min read at cybersecuritynews.com
A Firefox add-on posing as a tool for opening protected PDF documents can quietly turn a signed-in browser into a route to Google account theft. It waits until installation to obtain the instructions that make it dangerous, leaving little suspicious code for store reviewers. The extension appeared in the Firefox Add-ons store on September 3, […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.