A Firefox add-on marketed as a PDF viewing tool has been found arming itself only after installation, then quietly hijacking Google account sessions instead of doing anything related to PDFs.
What happened
The extension, distributed under the name "PDF Identity Verifier," ships clean — no hardcoded target list, no cookie-stealing code visible to reviewers or automated store scans. Its real behavior is fetched from an attacker-controlled domain only after the add-on is live in a user's browser, which is why it slipped past casual review.
Roughly five seconds after installation, the extension quietly loads a page designed to look like a Google-hosted service. That page reads Google's own sign-in state to confirm an account is already active on the device, then routes the browser through Google's legitimate sign-in flow — using the real service as cover so nothing about the process looks obviously fake.
While that flow runs, the extension injects a script that plays out largely behind a full-screen "verifying" overlay. It can trigger a passkey or security-key prompt, retry if a bot-detection check blocks it, and — in parallel — watch the browser's traffic for the session cookie that proves the account is signed in. Once captured, that cookie and the associated account details are sent to the attacker's server, effectively handing over a live, authenticated session without ever touching the account's original password.
If Google's own protections force a password reset during this process, the injected script can fill in and submit a new password on the victim's behalf while the overlay hides the activity — giving the attacker a second way back into the account even after the stolen session eventually expires.
Why it matters
The delay between installation and malicious activity is the core problem: it defeats point-in-time store reviews and quick manual checks, which only see the extension in its dormant state. Because the takeover happens inside Google's real sign-in flow rather than through a fake login page, there's no obvious phishing prompt for a user to notice — the visible sign of trouble is just an unusual verification screen. Session-cookie theft also bypasses password strength and MFA entirely: whoever holds the cookie is treated as an already-authenticated user.
Current reporting suggests this specific campaign has not produced a large confirmed victim count, but the technique — a browser extension that self-arms post-install and rides a legitimate identity provider's flow to steal sessions — is reusable well beyond this one add-on.
What to do
- Search installed Firefox profiles for extensions requesting broad storage, network, and Google-page permissions that don't match their stated purpose, and remove anything unverified or unused.
- If the extension is found installed, don't stop at uninstalling it: from a separate, trusted device, sign the affected Google account out of all sessions, revoke connected app access, and change the password.
- Review the account's recent sign-in activity, recovery email/phone, forwarding rules, and connected apps for changes made around the time of infection — a quiet password reset is one of this technique's signatures.
- Security teams should treat unexpected password-reset events with no matching user-initiated request as a priority signal, and block outbound traffic to known attacker infrastructure tied to this campaign at the network layer.
- Browser and endpoint management teams should audit extension installation records org-wide, since a clean-looking review at install time doesn't rule out delayed malicious behavior.