Security researchers have uncovered a troubling new malware campaign that has been hiding malicious code inside the logo images of popular Firefox browser extensions. The attack demonstrates how even trusted visual elements can be weaponized to compromise user security.
The campaign, dubbed “GhostPoster”, was uncovered by cybersecurity firm Koi Security, which identified at least 17 compromised Firefox add-ons affecting more than 50,000 users. These extensions presented themselves as legitimate tools such as free VPNs, weather widgets, ad blockers, translation utilities, and mouse gesture helpers.
Despite their harmless appearance, the extensions secretly executed malware in the background, monitoring browsing activity and opening a hidden backdoor inside users’ browsers.
Instead of embedding malicious code where scanners typically search, attackers used a sophisticated technique known as steganography. The malicious JavaScript was concealed inside the raw data of the extensions’ PNG logo images.
When the extension loaded, it quietly read its own logo file, extracted the hidden code, and executed it. The image appeared completely normal to users, allowing the malware to evade detection.
GhostPoster was engineered for stealth. The loader delayed activation for 48 hours and fetched the main malware payload only 10% of the time. This tactic made detection through network monitoring and sandbox analysis extremely difficult.
Once activated, the payload was encrypted, obfuscated, and stored within the browser, enabling long-term persistence and future malicious upgrades.
Although GhostPoster did not directly steal passwords, it posed a significant privacy and security risk. According to researchers, the malware could:
The compromised add-ons came from widely used categories, including:
Mozilla confirmed that it removed all identified extensions from the Firefox Add-ons Marketplace and updated its automated detection systems to prevent similar attacks in the future.
“User safety is something we’ve always prioritized and taken very seriously,” a Mozilla spokesperson stated.
Security experts recommend that users immediately uninstall any affected extensions, reset important account passwords, and exercise caution when installing browser add-ons, particularly those offering free services like VPNs.
The GhostPoster campaign serves as a stark reminder that even trusted browser extensions can be weaponized — sometimes hiding malware in places users least expect.