Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts

Socket researchers identified a malicious Firefox add-on, PDF Identity Verifier, that impersonates a protected-PDF identity-checking tool while targeting Portuguese- and Spanish-speaking users and facilitating Google account takeover. Published on September 3, 2026, it initially appeared benign because its store-submitted code contained no explicit malicious URLs, credential theft logic, or payload; instead, after installation it contacted an attacker-controlled lookalike domain, downloaded configuration and scripts, and activated its harmful functions at runtime. The extension injected code into legitimate accounts.google.com pages, displayed a fake identity-validation overlay, automated Google sign-in and security flows, captured OAuth session cookies from Google responses, and in some cases silently reset victims’ passwords to attacker-controlled values while transmitting live activity data to attacker infrastructure. Although the extension reportedly had few users and a low expected impact, its post-install payload delivery illustrates a method for evading static review and detection. Recommended remediation includes removing and blocking the extension identifier, ending Google sessions, resetting credentials from a clean device, reviewing recovery and multifactor settings and account activity, blocking the malicious domain, and treating affected Firefox profiles as compromised.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.