Using logo files linked to 17 Mozilla Firefox browser add-ons, a new campaign called GhostPoster has embedded malicious JavaScript code intended to steal affiliate links, insert tracking code, and commit click and ad fraud.
Koi Security, which found the campaign, claims that the extensions have been downloaded more than 50,000 times in total. The add-ons are no longer accessible.
These browser apps were marketed as unofficial Google Translate versions, screenshot tools, VPNs, and ad blockers. Dark Mode, the oldest add-on, was released on October 25, 2024, and it allows all websites to have a dark theme. Below is a complete list of browser add-ons.
- Free VPN
- Screenshot
- Weather (weather-best-forecast)
- Mouse Gesture (crxMouse)
- Cache – Fast site loader
- Free MP3 Downloader
- Google Translate (google-translate-right-clicks)
- Traductor de Google
- Global VPN – Free Forever
- Dark Reader Dark Mode
- Translator – Google Bing Baidu DeepL
- Weather (i-like-weather)
- Google Translate (google-translate-pro-extension)
According to security researchers Lotan Sery and Noga Gouldman, what they really offer is a multi-stage malware payload that tracks everything you visit read more about GhostPoster Malware Found in 17 Firefox Add-ons with 50000+ Downloads.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.