hxxps://accounts.google[.]com/gsi/fedcm.jsonURL
Reported by 1 independent source · first reported by Socket · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts“…ogle's real Federated Credential Management (FedCM) API — navigator.credentials.get({identity:{providers:[{configURL:"<hxxps://accounts.google[.]com/gsi/fedcm.json>"}]}}) — to silently identify the victim's signed-in Google account, resolving a leadId and email.”
Indicators reported together
named in the same reports- gusercontent[.]comin 1 report
- hxxps://*.google[.]com/*in 1 report
- hxxps://pdf.gusercontent[.]com/oninstalledin 1 report
- pdf.gusercontent[.]comin 1 report
- event[.]datain 1 report
- sender.tab[.]idin 1 report
- header[.]namein 1 report
- hxxps://pdf.gusercontent[.]com/api/accounts/collect/?leadId=in 1 report
- hxxps://pdf.gusercontent[.]com/api/accounts/collect/?leadId=$in 1 report
- hxxps://accounts.google[.]com/EmbeddedSetup?Email=in 1 report
- f1b8329075b1cbd1…0b10aee9f2b1in 1 report
- 16447c70f8e3c99d…8da4c279880ain 1 report
- dc717b5ab9a8eccf…ccc33d1c6e3ein 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.