Malicious Firefox Extension that Allows Attackers to Access and Control Users’ Gmail Accounts


Malicious Firefox Extension

Proofpoint Threat Research has tracked low-volume phishing campaigns targeting Tibetan organizations globally. In January and February 2021, experts observed threat actors aligned with the Chinese Communist Party’s state interests delivered a customized malicious Mozilla Firefox browser extension that facilitated access and control of users’ Gmail accounts.

Proofpoint has named this malicious browser extension “FriarFox” and attributes this activity to TA413, who in addition to the FriarFox browser extension, was also observed delivering both Scanbox and Sepulcher malware to Tibetan organizations in early 2021.

Read more…