Executive Summary
In September 2026, a malicious Firefox extension titled "PDF Identity Verifier" (pdf-para-texto@extensao.local) was identified targeting Google account users. The extension employs a sophisticated detection-evasion technique by shipping as a "clean" dispatcher with no hardcoded malicious logic. After installation, it fetches a remote configuration from attacker-controlled infrastructure to arm its malicious functions, specifically targeting users in Portuguese and Spanish-speaking regions.
The attack chain involves monitoring network requests for Google authentication tokens and injecting a remote-controlled account-takeover bot into legitimate accounts.google.com pages. This bot can bypass bot detection, exfiltrate live session telemetry, and silently reset account passwords if prompted by Google's risk engine. The use of a lookalike domain (pdf[.]gusercontent[.]com) and FedCM API abuse allows the attacker to identify victims and maintain persistence even after initial session theft.
While the current user base is low, the extension represents a significant evolution in browser-based threats. It bypasses static analysis by defining malicious behaviors (such as exfiltration endpoints and injection scripts) as runtime data rather than static code. Organizations should prioritize blocking the associated infrastructure and auditing browser extensions across managed endpoints.