Malicious Firefox extension hijacks Google accounts

Socket: Firefox add-on posing as a PDF identity verifier hijacks
Google accounts (session/OAuth). Browser-store supply chain, same class
as AS58/AS60.

Mapped techniques

T0109 Publish malicious artifact
T0136 Brandjacking
T0184 Harvesting sensitive information from files

supply-chain campaign

T0109 · Resource Development · Publish malicious artifact

Firefox Add-ons listing.

T0136 · Initial Access · Brandjacking

PDF identity-verifier impersonation.

T0184 · Credential Access · Harvesting sensitive information from files

Google account session.

Sources

https://socket.dev/blog/firefox-google-account-takeover