Fake Firefox Extension Hijacks Google Accounts Without Stealing Passwords First
A fake Firefox PDF extension steals Google oauth_token cookies and automates account takeover after install.
Socket found a Firefox add-on posing as a PDF identity-verification tool that looks benign in static review, then loads attacker configuration from pdf.gusercontent.com after install. Published on September 3, 2026, it gained malicious behavior in version 1.4 on September 11. It captures Google Set-Cookie values containing oauth_token and can inject automation into accounts.google.com to drive recovery flows and set a new password. Immediate impact is assessed as low because the extension has no substantial user base; lures support Portuguese, Spanish, and English.
- Malicious logic arrives as remote configuration, not packaged code.
- Steals oauth_token cookies for session hijacking without passwords.
- Can reset Google passwords behind a full-screen validation overlay.
- Published on Firefox Add-ons; user base and impact assessed as low.
- Hunt for pdf.gusercontent.com and broad webRequest permissions.
- Products
- FirefoxGoogle Account
- Malware
- Fake Firefox PDF extension
- Organizations
- Socket
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | pdf.gusercontent.com | acker-controlled infrastructure. The installed add-on opens pdf[.]gusercontent[.]com/oninstalled after a five-second delay. The domain imita |
| sha256 | 16447c70f8e3c99de95b92846460214a661915c89f5c10965bf18da4c279880a | k/assets/index-BhOgWOaO.js JavaScript loader payload script 16447c70f8e3c99de95b92846460214a661915c89f5c10965bf18da4c279880a Account-takeover payload Google account takeover payload Fi |
| sha256 | dc717b5ab9a8eccf6b6187880ba90b004cb00f503ff8bceb8405ccc33d1c6e3e | payload used to facilitate Google account takeover activity dc717b5ab9a8eccf6b6187880ba90b004cb00f503ff8bceb8405ccc33d1c6e3e Note: IP addresses and domains are intentionally defanged ( |
| sha256 | f1b8329075b1cbd1ae0a5dc947bd00f94642cb166a86c2455a1d0b10aee9f2b1 | d landing page associated with the malicious infrastructure f1b8329075b1cbd1ae0a5dc947bd00f94642cb166a86c2455a1d0b10aee9f2b1 Loader payload pdf[.]gusercontent[.]com/loginSdk/assets/ind |
From the original article
4 min read at gbhackers.com
A malicious Firefox extension masquerading as a PDF identity-verification utility has been found targeting Google accounts through session-cookie theft and automated account-takeover activity. The campaign is notable because the add-on initially contains no obvious credential-stealing code, malicious URLs, or hardcoded payloads, allowing it to appear benign during basic static analysis.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.