hxxps://pdf.gusercontent[.]com/api/accounts/collect/?leadId=URL
Reported by 1 independent source · first reported by Socket · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts“"hxxps://pdf.gusercontent[.]com/api/accounts/collect/?leadId=", //[13] exfil url”
Indicators reported together
named in the same reports- gusercontent[.]comin 1 report
- hxxps://*.google[.]com/*in 1 report
- hxxps://pdf.gusercontent[.]com/oninstalledin 1 report
- pdf.gusercontent[.]comin 1 report
- event[.]datain 1 report
- sender.tab[.]idin 1 report
- header[.]namein 1 report
- hxxps://pdf.gusercontent[.]com/api/accounts/collect/?leadId=$in 1 report
- hxxps://accounts.google[.]com/gsi/fedcm.jsonin 1 report
- hxxps://accounts.google[.]com/EmbeddedSetup?Email=in 1 report
- f1b8329075b1cbd1…0b10aee9f2b1in 1 report
- 16447c70f8e3c99d…8da4c279880ain 1 report
- dc717b5ab9a8eccf…ccc33d1c6e3ein 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.