#ParsedReport #CompletenessLow
23-09-2026

Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts

https://socket.dev/blog/firefox-google-account-takeover

Report completeness: Low

Threats:
Credential_stealing_technique

Victims:
Google accounts, Portuguese speaking users, Spanish speaking users

TTPs:
Tactics: 2
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1036, T1059.007, T1071.001, T1105, T1176, T1185, T1539, T1556

IOCs:
File: 28
Url: 7
Domain: 1
Hash: 3

Soft:
Firefox

Functions:
init, setTimeout, Set-Cookie

Win API:
sendMessage