GhostPoster attacks hide malicious JavaScript in Firefox addon logos

A new cybercrime campaign called 'GhostPoster' is distributing malicious Firefox extensions that hide JavaScript code within addon logo images. The campaign has achieved over 50,000 downloads across multiple malicious extensions. The malware monitors browser activity and establishes backdoor access to infected systems. The attack technique involves steganography to conceal malicious code within image files, making detection more difficult. This represents an active threat to Firefox users who install extensions from unofficial sources.