GhostPoster Firefox Extensions Hide Malware in Icons

SecurityWeek reports that GhostPoster is a campaign in which Firefox extensions hide malware in their icons using steganography, with the extensions posing as free VPN services, ad blockers, translation tools, and weather forecast apps.

According to Koi, which named the campaign GhostPoster, at least 17 extensions have been published to the browser’s add-ons marketplace and have been installed approximately 50,000 times; one extension, Free VPN Forever, was published in September 2025 and has been installed over 16,000 times.

The extensions load their logo files, scan the raw bytes for a specific marker, and then load a loader that reaches a remote command-and-control server to fetch an encrypted payload, evading detection by delaying the initial call to C&C and only fetching a payload in about 10% of successful connections.

The loader decrypts the payload, a toolkit for user tracking and browser monetisation, encrypts it again, and stores it in browser storage for persistence, with additional time delays to activate the malware more than six days after installation.

The malware monitors visits to ecommerce sites to intercept and replace affiliate links, injects Google Analytics tracking, harvests data on installed extensions, and injects elements on certain sites to profile users without their knowledge, while exposing users to clickjacking and cross-site scripting by removing security headers and injecting code into pages. Some variants connect to the same two C&C servers and are linked to the same threat actor, according to Koi.