f1b8329075b1cbd1ae0a5dc947bd00f94642cb166a86c2455a1d0b10aee9f2b1SHA-256 hash
Reported by 1 independent source · first reported by Socket · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts“f1b8329075b1cbd1ae0a5dc947bd00f94642cb166a86c2455a1d0b10aee9f2b1 - onInstalled landing page”
Indicators reported together
named in the same reports- gusercontent[.]comin 1 report
- hxxps://*.google[.]com/*in 1 report
- hxxps://pdf.gusercontent[.]com/oninstalledin 1 report
- pdf.gusercontent[.]comin 1 report
- event[.]datain 1 report
- sender.tab[.]idin 1 report
- header[.]namein 1 report
- hxxps://pdf.gusercontent[.]com/api/accounts/collect/?leadId=in 1 report
- hxxps://pdf.gusercontent[.]com/api/accounts/collect/?leadId=$in 1 report
- hxxps://accounts.google[.]com/gsi/fedcm.jsonin 1 report
- hxxps://accounts.google[.]com/EmbeddedSetup?Email=in 1 report
- 16447c70f8e3c99d…8da4c279880ain 1 report
- dc717b5ab9a8eccf…ccc33d1c6e3ein 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.