GhostPoster Malware Found in 17 Firefox Add-ons with 50,000+ Downloads

A campaign named GhostPoster has leveraged logo files associated with 17 Mozilla Firefox browser add-ons to embed malicious JavaScript designed to hijack affiliate links, inject tracking code, and commit ad fraud; the extensions were downloaded collectively over 50,000 times, according to Koi Security, which discovered the campaign. The add-ons are no longer available, and the oldest, Dark Mode, was published on 25 October 2024.

The attack chain begins when the logo file is fetched as the add-on loads, with the malicious code parsing the file to extract JavaScript from a marker and then contacting external servers to retrieve the main payload, waiting 48 hours between attempts. The malicious loader is configured to fetch the payload only 10% of the time to evade detection, and the resulting toolkit can monetise browser activity via affiliate hijacking, tracking injection, security header stripping, and hidden iframe injection.

Researchers said the operation appears to be conducted by a single threat actor or group, which has experimented with different lures while communicating with the same C2 infrastructure.