Skip to content

Back to the catalog

Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts
socket.devwriteup

Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts

Socket's Threat Research team dissects a malicious Firefox extension (pdf-para-texto@extensao.local, "PDF Identity Verifier") that ships with no hardcoded malicious code — all attack logic is fetched as data into browser.storage.local after install via a lookalike domain (pdf.gusercontent.com), evading static store review. Once armed, it abuses Google's FedCM API to silently identify the victim, injects a live automation script into real accounts.google.com pages to drive an invisible account-takeover flow (bypassing password entry, forcing passkey challenges, dodging Google's bot detection, and forcing/capturing a password reset), while a webRequest listener steals the oauth_token session cookie from Set-Cookie headers — giving the attacker both a live session and a durable new password. The campaign targets Portuguese- and Spanish-speaking users starting September 2026 and includes full IOCs (domains, file hashes) and remediation steps.

TL;DR A fake "PDF Identity Verifier" Firefox extension ships clean but pulls a remote config post-install to silently hijack Google accounts via FedCM abuse, injected automation on accounts.google.com, and oauth_token cookie theft.
Open original ↗
Document

What it is

Malicious Firefox extension pdf-para-texto@extensao.local ("PDF Identity Verifier"), published to the Firefox Add-ons store September 3, 2026, with malicious functionality introduced in version 1.4 on September 11, 2026. Socket assesses actual impact as low (no significant user base); its significance is the detection-evasion design. The existing summary covers the mechanism — this document carries the concrete IOCs, hashes, and remediation steps the summary only gestures at, plus a few technical specifics for detection.

Detection specifics the summary omits

  • content.js patches the WebAuthn PublicKeyCredential interface so capability checks always report a platform authenticator/passkey as available — a static-analysis tell.
  • The injected load-addon.js forces the passkey/security-key challenge via data-challengetype="53", and works around Google's bot-detection page (errors/robot.png) by re-navigating with an incrementing cid parameter.
  • It streams a live transcript (page text + interactive-element snapshot) to the attacker roughly every 500ms via a telemetry endpoint (/api/extlog).
  • The password-reset step (changepasswordform) sets a random valid password through the native HTMLInputElement value setter, logging it to the attacker.

What to do

Socket's stated remediation, in order:

  1. Remove the extension — uninstall and block identifier pdf-para-texto@extensao.local via browser-management policy.
  2. Terminate Google sessions — sign the user out of all sessions, revoke active tokens from a trusted device.
  3. Reset credentials from a known-clean device; re-enroll passkeys, security keys, recovery addresses/phones, and MFA.
  4. Review account activity — Google security events, login history, connected apps, forwarding rules, delegated access, recovery changes.
  5. Block infrastructure — hunt for and block all pdf[.]gusercontent[.]com paths.
  6. Inspect Firefox profiles — search for the extension identifier, its local-storage data, and install records; treat affected profiles as compromised.

IOCs

C2 / infrastructure (all pdf[.]gusercontent[.]com):

  • /oninstalled — install landing page
  • /loginSdk/assets/index-BhOgWOaO.js — loader payload
  • /loginSdk/load-addon.js — account-takeover payload
  • /api/accounts/collect/?leadId=&email=&data= — token exfiltration
  • /api/extlog — session telemetry
  • /reload — post-hijack redirect

File hashes (SHA-256):

f1b8329075b1cbd1ae0a5dc947bd00f94642cb166a86c2455a1d0b10aee9f2b1  onInstalled landing page
16447c70f8e3c99de95b92846460214a661915c89f5c10965bf18da4c279880a  loader payload script
dc717b5ab9a8eccf6b6187880ba90b004cb00f503ff8bceb8405ccc33d1c6e3e  account-takeover payload

Note the lookalike: gusercontent[.]com (attacker) vs. Google's legitimate googleusercontent.com.

Organisations named here

  • pdf.gusercontent.com

Technologies named here

  • Mozilla Firefox
  • pdf-para-texto@extensao.local
  • Google Account / accounts.google.com
  • background.js
  • Firefox Add-ons store
  • content.js
  • index-BhOgWOaO.js
  • load-addon.js
  • Google FedCM API
  • Firefox
  • Socket
  • OAuth

Techniques named here

  • Delayed/staged payload delivery to evade store review
  • Generic dispatcher / indirect function invocation
  • Lookalike domain
  • Abuse of legitimate FedCM API
  • Session cookie theft via webRequest API
  • Fake UI overlay to conceal automation
  • Automated sign-in flow manipulation / bot-detection evasion
  • Forced password reset for credential capture
  • Live session telemetry exfiltration
  • Open postMessage bridge for privilege escalation

Related in Supply Chain