Eight Malicious Firefox Extensions Expose Users to Credential Theft and Surveillance

The Socket Threat Research Team recently discovered a troubling network of malicious Firefox browser extensions that pose serious threats to user security and privacy.

Initially focusing on a single extension, “Shell Shockers,” which redirected users to tech support scam sites, the probe expanded to reveal a coordinated campaign by threat actor “mre1903.”

This actor, active since June 2018, has orchestrated a series of fake gaming extensions mimicking popular titles like “Little Alchemy 2,” “1v1.LOL,” “Krunker io Game,” “Five Nights at Freddy’s,” and “Bubble Spinner.”

Deceptive Gaming Extensions

Far from delivering gaming functionality, these extensions redirect unsuspecting users to gambling sites and fraudulent Apple virus alert pages with fabricated error codes like “0x800VDS.”

Their use of familiar game names exploits user trust, making the social engineering tactic particularly effective, while immediate popup ...