A Firefox add-on called PDF Identity Verifier promised to check a user's identity before opening a protected PDF. What it actually did, once installed, was quietly take over the user's Google account, and the code that store reviewers could inspect contained none of the instructions for doing it.
Karlo Zanki of Socket's Threat Research team documented the extension on September 23. It was published to the Firefox Add-ons store on September 3, 2026, and the malicious behaviour first arrived in version 1.4 on September 11. Socket says the add-on never built a significant user base and rates the expected impact as fairly low. The reason it matters is the design: every file shipped to the store was, on its own, clean. Peru's national digital security centre (CNSD) relayed the warning in its integrated security alert 182-2026.
The instructions only arrive after install
The extension's background script is what Socket calls a generic interpreter: a dispatcher that can call any browser function named in a stored configuration, which is empty when the add-on is installed. There is no target URL, no exfiltration address and no credential-stealing logic in the package. A static scanner sees an empty shell.
Five seconds after installation, the add-on opens a page on pdf[.]gusercontent[.]com, a lookalike domain chosen to resemble Google's real googleusercontent.com. A script on that page silently identifies the victim's signed-in Google account through Google's own Federated Credential Management API, then pushes a configuration and a second script into the extension's local storage. Only then does the add-on know what to watch and where to send it.
Two routes into the same Google account
Once armed, the extension watches responses from Google domains for a session cookie containing oauth_token and sends its value, with the victim's email address, to the attacker's collection endpoint. At the same time it injects the downloaded script into real accounts.google.com pages. That script covers the screen with a fake "Validating your identity" overlay, drives Google's sign-in flow in the background, forces the passkey or security-key challenge, and retries when Google's bot check blocks it.
If Google demands a password reset along the way, the script generates a new password, submits it, and logs it for the operator. The victim's real account password is changed to one only the attacker knows. Socket notes the extension also patches the browser's WebAuthn interface so passkey capability checks always report a platform authenticator as available, and streams a live transcript of the page to the attacker roughly every 500 milliseconds.
The lure text is written in Portuguese and the add-on is localised for Portuguese, Spanish and English, which Socket reads as a campaign aimed at Portuguese- and Spanish-speaking users. That echoes the Brazilian banking malware that slipped a fake extension past Chrome earlier this month, and the session-theft angle mirrors earlier research on Google passkey hijacking.
Remove the add-on, then treat the account as stolen
- Uninstall PDF Identity Verifier and block the extension ID pdf-para-texto@extensao.local through browser management policy.
- Sign the user out of all Google sessions and revoke active tokens from a known-clean device.
- Change the Google password from a clean device, then review and re-enrol passkeys, security keys, recovery email and phone, and MFA methods.
- Check Google security events, connected apps, forwarding rules and delegated access for changes.
- Block pdf[.]gusercontent[.]com and treat any Firefox profile that ran the add-on as compromised.
Indicators
- C2 domain: pdf[.]gusercontent[.]com (paths /oninstalled, /loginSdk/load-addon.js, /api/accounts/collect/, /api/extlog, /reload)
- Landing page SHA-256: f1b8329075b1cbd1ae0a5dc947bd00f94642cb166a86c2455a1d0b10aee9f2b1
- Loader script SHA-256: 16447c70f8e3c99de95b92846460214a661915c89f5c10965bf18da4c279880a
- Account takeover payload SHA-256: dc717b5ab9a8eccf6b6187880ba90b004cb00f503ff8bceb8405ccc33d1c6e3e
The numbers here are small, and Socket says so. The lesson is not. An extension that ships as a content-free dispatcher gives a store reviewer nothing to reject, which means the only reliable control is deciding in advance which add-ons a managed browser may run at all.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.