Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts

Socket's Threat Research team discovered a malicious Firefox extension named 'pdf-para-texto@extensao.local', posing as a PDF identity verification tool. Published September 3, 2026, the extension ships with no hardcoded malicious code, evading static analysis and store reviewers. After installation, it fetches a remote payload from attacker-controlled infrastructure (pdf[.]gusercontent[.]com) and arms itself with a configuration object enabling full Google account takeover. The extension injects scripts into real accounts.google.com pages, steals Google oauth_token session cookies via webRequest interception, and can silently change the victim's Google account password. It uses FedCM API calls to identify victims, streams live session telemetry to the attacker every 500ms, and targets Portuguese- and Spanish-speaking users. The campaign's significance lies in its sophisticated detection-evasion architecture rather than its current scale, which remains limited.