16447c70f8e3c99de95b92846460214a661915c89f5c10965bf18da4c279880aSHA-256 hash
Reported by 1 independent source · first reported by Socket · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts“16447c70f8e3c99de95b92846460214a661915c89f5c10965bf18da4c279880a - loader payload script”
Indicators reported together
named in the same reports- gusercontent[.]comin 1 report
- hxxps://*.google[.]com/*in 1 report
- hxxps://pdf.gusercontent[.]com/oninstalledin 1 report
- pdf.gusercontent[.]comin 1 report
- event[.]datain 1 report
- sender.tab[.]idin 1 report
- header[.]namein 1 report
- hxxps://pdf.gusercontent[.]com/api/accounts/collect/?leadId=in 1 report
- hxxps://pdf.gusercontent[.]com/api/accounts/collect/?leadId=$in 1 report
- hxxps://accounts.google[.]com/gsi/fedcm.jsonin 1 report
- hxxps://accounts.google[.]com/EmbeddedSetup?Email=in 1 report
- f1b8329075b1cbd1…0b10aee9f2b1in 1 report
- dc717b5ab9a8eccf…ccc33d1c6e3ein 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.