Browser add-ons are supposed to make life easier. They translate a paragraph, darken an aggressively bright website, block irritating ads, or provide a quick weather forecast. In the GhostPoster malware campaign, however, several Firefox extensions came with an unadvertised bonus feature: quietly turning the browser into a remote-controlled money-making machine.
Security researchers disclosed in December 2025 that 17 malicious Firefox add-ons had accumulated more than 50,000 combined installations. The extensions posed as familiar utilities, including free VPNs, translation tools, screenshot helpers, weather widgets, ad blockers, a dark-mode tool, and an MP3 downloader.
The campaign was especially notable because malicious JavaScript was hidden inside an unlikely location: an extension’s PNG logo. The picture still looked normal, but extra data concealed within the file could be extracted and executed. Apparently, even toolbar icons can have a secret nightlife.
What Happened in the GhostPoster Firefox Campaign?
The campaign, named GhostPoster by Koi Security, was initially uncovered while researchers examined an extension called Free VPN Forever. The add-on read its own logo file and searched through its raw bytes for a special marker. Data placed after that marker contained JavaScript instructions.
The hidden script was not necessarily the final malware. It operated as a loader that contacted attacker-controlled infrastructure and attempted to retrieve another payload. The downloaded code could then monitor browsing activity, inject tracking components, manipulate affiliate links, weaken browser security protections, and generate fraudulent advertising traffic.
Free VPN Forever alone reportedly had more than 16,000 installations. Researchers subsequently identified 16 additional extensions connected to the same command-and-control infrastructure, bringing the combined total above 50,000 installations.
That figure should be interpreted carefully. It represents reported marketplace installations or downloads across the extensions, rather than a confirmed count of 50,000 individually examined victims. Some installations may have been inactive, removed early, or never received the remote payload because of the campaign’s selective activation methods.
The 17 Malicious Firefox Add-Ons
The affected add-ons used names associated with popular browser features. Some reports displayed user-facing titles, while technical investigations documented their marketplace slugs. The identified list included:
free-vpn-foreverFree VPNscreenshot-saved-easyScreenshotweather-best-forecastWeathercrxmouse-gestureMouse Gesturecache-fast-site-loaderCache/Fast Site Loaderfreemp3downloaderFree MP3 Downloadergoogle-translate-right-clicksGoogle Translategoogle-traductor-espTraductor de Googleworld-wide-vpnGlobal VPN/Free Foreverdark-reader-for-ffDark Reader Dark Modetranslator-gbbdTranslator for Google, Bing, Baidu, and DeepLi-like-weatherWeathergoogle-translate-pro-extensionGoogle Translate Pro Extension谷歌-翻译Google Translatelibretv-watch-free-videosLibreTV Watch Free Videosad-stopAd Stop/Best Ad Blockerright-click-google-translateRight-Click Google Translate
The names are a useful lesson by themselves. Attackers did not invent unusual products called “Definitely Not Malware Deluxe.” They chose ordinary, high-demand functions that people search for every day. They also used names resembling familiar products or services, increasing the chance that a hurried user would click Install without investigating the developer.
How the Malware Hid Inside a PNG Logo
Stage 1: Concealing JavaScript in an Image
In some of the extensions, the attackers used a concealment technique commonly described as steganography. A PNG image can continue to display correctly even when additional information has been appended to its file data.
The suspicious extension code read the logo as raw bytes and searched for three equal signs: ===. Everything after that marker was treated as hidden JavaScript. To a user, the icon remained a harmless little picture. To the extension, it was an envelope containing executable instructions.
This approach helped the add-ons avoid basic static inspection. A scanner concentrating on obvious JavaScript files might not recognize that an image contained code. However, not every extension in the campaign used precisely the same technique. Researchers found several delivery variations, including direct downloads and encoded calls to the same infrastructure.
Stage 2: Contacting Remote Servers
The extracted JavaScript functioned as a loader. It attempted to contact remote command-and-control servers, including infrastructure associated with the defanged domains liveupdt[.]com and dealctr[.]com.
The add-ons did not constantly download their payloads. Investigators found delays of roughly 48 hours between check-ins, along with probability checks that caused a payload request to occur only about 10% of the time. This inconsistent behavior reduced the chance that an automated review or a researcher observing the add-on for a few hours would see anything suspicious.
Additional timing logic could postpone meaningful malicious activity for days after installation. By then, the user had probably forgotten about the new extension and moved on to more pressing concerns, such as why the office printer had once again entered a state of spiritual rebellion.
Stage 3: Encoding and Persistent Storage
When the remote payload arrived, it was transformed using multiple lightweight encoding steps. Researchers described character-case swapping, substitutions involving the numbers eight and nine, and Base64 decoding. The decoded content was then protected with an XOR operation tied to the extension’s runtime identifier and stored within browser storage.
None of those techniques is magical on its own. Their value came from layering several modest defenses: hidden code, remote loading, delayed activation, randomized execution, custom encoding, and encrypted storage. Together, they complicated automated analysis and made the malware less predictable.
What Could the Malicious Extensions Do?
Hijack Affiliate Commissions
GhostPoster watched for visits to certain e-commerce platforms. When a user followed an affiliate link, the malware could replace the original tracking information with identifiers controlled by the operators. The shopper still reached the expected product page and paid the same price, but the legitimate publisher or creator lost the commission.
This type of fraud is nearly invisible to the buyer. There is no dramatic pop-up or spinning skull. The transaction simply credits the wrong party, one quiet commission at a time.
Track Browsing Activity
The observed payload injected analytics tracking into pages and collected information such as the extension’s installation age, merchant networks visited, and a browser-linked identifier. Hidden page elements could also carry tracking attributes that helped profile activity.
Researchers reported a Google Analytics identifier associated with the campaign. The tracking behavior was unrelated to the advertised purposes of tools such as weather widgets or translation extensions.
Remove Important Security Headers
The malware could strip headers such as Content-Security-Policy and X-Frame-Options from web responses. These protections help websites restrict unauthorized scripts, framing, and clickjacking techniques.
Removing them did not automatically compromise every website, but it weakened safeguards that browsers and site owners rely on. It was the digital equivalent of quietly removing door locks and hoping nobody noticed the breeze.
Inject Invisible Frames and Bypass CAPTCHA Checks
The payload could create hidden iframes that loaded attacker-selected pages. These invisible frames were reportedly used for tracking, artificial ad impressions, or click fraud and could disappear after approximately 15 seconds.
The malware also contained several CAPTCHA-bypass methods. Such features could help automated activity resemble legitimate human browsing and continue generating traffic without being blocked by anti-bot systems.
Maintain a Browser Backdoor
The most concerning issue was not limited to the functions researchers observed. Because the extensions could retrieve and execute updated code from remote servers, the operators retained the ability to change their instructions.
The original analysis focused on tracking, affiliate manipulation, weakened security controls, and advertising fraud. It did not establish that every user’s passwords were stolen. Nevertheless, an extension capable of reading and modifying pages across many websites creates a serious potential exposure, especially when its payload can be changed remotely.
How Mozilla Responded
After investigating the report, Mozilla removed the identified extensions from its official Firefox Add-ons marketplace. The company also said it updated automated systems to detect and block extensions using similar attack methods.
Marketplace removal prevents new users from installing the listed versions through the store, but it does not erase the incident’s broader lesson. Official marketplaces reduce risk; they do not make every upload permanently trustworthy. Review systems must evaluate thousands of submissions and updates, while malicious developers need only find one overlooked path.
Later research connected GhostPoster to a wider collection of suspicious extensions affecting Firefox and Chromium-based browsers. That subsequent wave reportedly involved a different set of 17 extensions and approximately 840,000 installations. It should not be confused with the original 17 Firefox add-ons discussed here.
What to Do If You Installed One of the Add-Ons
1. Remove the Extension
Open Firefox, type about:addons in the address bar, and press Enter. Select Extensions, locate the affected add-on, open its menu, and choose Remove. Do not merely hide its toolbar icon; hiding an icon does not uninstall the underlying extension.
2. Review Every Remaining Extension
While the extensions page is open, remove tools you no longer use, do not recognize, or cannot confidently connect to a reputable developer. Browser add-ons are software, not decorative refrigerator magnets. Each additional extension expands the browser’s attack surface.
3. Update Firefox and Restart It
Install the latest stable Firefox update and restart the browser. Updates provide current security fixes and allow Mozilla’s latest blocking and detection mechanisms to take effect.
4. End Sensitive Sessions
Sign out of important services used while the extension was present, particularly email, banking, shopping, cloud storage, workplace systems, and social networks. Use each service’s security page to review active devices and revoke unfamiliar sessions.
5. Change High-Value Passwords
Although credential theft was not the central behavior documented in the original GhostPoster report, changing passwords for critical accounts is a sensible precaution when an extension had broad page access. Begin with the primary email account because it can often reset passwords for other services.
Create unique passwords and enable multifactor authentication. A password manager can generate and store credentials so that “Summer2026!” does not end up guarding half of your online life.
6. Scan the Device
Run an updated security scan using a trusted endpoint protection product. GhostPoster operated primarily inside the browser, but a scan can identify unrelated malware, unwanted applications, or additional persistence mechanisms.
7. Watch for Suspicious Account Activity
Review login alerts, purchase histories, payment records, email forwarding rules, and account recovery settings. Contact the relevant provider immediately if you discover unauthorized changes.
How to Avoid Malicious Firefox Extensions
Start by installing fewer add-ons. A translation tool used twice a year may not deserve continuous access to every page you visit. Consider whether Firefox or a trusted website already provides the same feature.
Read permission warnings carefully. Requests to access data on all websites, modify downloads, manage tabs, intercept web requests, or read clipboard contents can be legitimate for certain tools, but the permissions should match the advertised function. A weather extension requesting broad control over every shopping and banking page deserves more scrutiny than the forecast itself.
Examine the developer’s history, privacy policy, support site, update record, and other products. Be cautious with copycat names that resemble established extensions. Popularity and positive reviews are useful signals, but neither guarantees safety because reviews can be manipulated and legitimate extensions can change ownership.
For organizations, browser-extension management should be treated as an application-security problem. Administrators can maintain an approved list, block unreviewed extensions, monitor installed versions, limit unnecessary permissions, and investigate unexpected network traffic from browser processes.
Practical Experience: What a Firefox Extension Audit Looks Like
Consider a realistic cleanup exercise involving a user who installed a free VPN extension several months earlier. The person does not remember its exact name because the add-on was installed for one weekend trip and then forgotten. That detail is common: extensions are easy to add, rarely revisited, and often synchronized across computers.
The audit begins at about:addons. Eleven extensions are installed. Four are clearly used every day: a password manager, an accessibility tool, a trusted content blocker, and an extension required by the employer. Three more have recognizable names but have not been used recently. The remaining four are mysteries.
The first useful experience is that memory is a poor security inventory. The user confidently insists there are “maybe five” extensions, yet the browser lists more than twice that number. Two were installed for one-time tasks. One appeared through browser synchronization from an old laptop. Another has a generic name and no memorable developer identity.
Each extension is then evaluated against three questions: Is it still needed? Is the developer trustworthy? Do its permissions make sense? The generic weather tool fails all three. Firefox already displays weather through several trusted sites, the developer has little verifiable history, and the extension wants access to data on every website. It is removed.
Next comes the VPN. The user assumed that adding a VPN extension was roughly equivalent to installing a full VPN application. It was not. Some browser VPN add-ons proxy only browser traffic, and the quality, ownership, logging practices, and security controls vary dramatically. The extension is removed because its origin cannot be verified.
The audit also uncovers a screenshot utility with permission to access every page. That access may be required to capture full-page images, but the user only needs screenshots twice a month and can use Firefox’s built-in screenshot feature. Removing the add-on eliminates a permission-heavy tool without eliminating the underlying capability.
After reducing the list from eleven extensions to six, Firefox is updated and restarted. The user signs out of sensitive accounts, checks active email sessions, enables multifactor authentication on two accounts that lacked it, and changes the password for the primary email address. A security scan finds no additional malware.
The biggest lesson is not that every free utility is malicious. Most are not. The lesson is that convenience creates long-lived trust. An extension installed in 30 seconds may retain powerful permissions for years, receive automatic updates, and follow the user to new computers through synchronization.
A second lesson is that an add-on can behave normally while conducting unrelated activity in the background. GhostPoster’s affected tools could still deliver visible features. A working translation button does not prove that translation is the only thing happening.
Finally, the audit demonstrates why a small extension inventory is easier to defend. When only a few essential add-ons remain, unusual permissions, unfamiliar names, and unexpected updates are more noticeable. Browser hygiene is not glamorous, but neither is discovering that a cheerful weather icon has been moonlighting as an advertising-fraud employee.
Conclusion
The GhostPoster campaign showed how malicious Firefox add-ons could hide executable instructions inside ordinary image files, delay their behavior, retrieve changing payloads, and quietly monetize browsing activity. The 17 identified extensions exceeded 50,000 combined installations before being removed from Mozilla’s marketplace.
The incident does not mean Firefox add-ons are inherently unsafe. It does mean users should treat extensions as privileged software. Install only what is necessary, investigate developers, question broad permissions, remove abandoned tools, and periodically review everything listed at about:addons.
A browser extension may occupy only a few pixels on the toolbar, but its access can extend across almost every website a person visits. In cybersecurity, size is rarely a reliable measure of trouble.
