GhostPoster Malware Hides Malicious JavaScript in Firefox Add-on Logos

[johny899]

Did you know that malware can be included in an add-on logo for Firefox? I know that I was surprised when I found out that this was true, but the GhostPoster attack has shown us that this does happen and it is something every Firefox user should be made aware of.

What Is GhostPoster?​

GhostPoster is a type of malware attack that uses fake Firefox add-ons as the cover for malware. These types of add-ons appear to be "safe" and "normal", such as a VPN or a browser tool. However, the malware is contained within the image file of the add-on rather than within the add-on program itself.

This may sound odd, but this is exactly what makes the GhostPoster malware so dangerous.

How The Attack Works​

Here’s how the GhostPoster malware attacks users:

• An image file containing JavaScript code will be included in the add-on’s logo.
• Firefox will load the image file when the add-on is executed.
• When the image file is loaded, the malware code will begin operating in the background.
• Finally, the add-on will establish a connection to the hacker's server.

Because very few security checks examine the contents of an image file, the chances of catching this type of attack are slim.

What Can The Malware Do?​

Once malware is executed, it has a significant impact on you, such as:

• Monitoring the sites you visit
• Modifying URLs so attackers earn money
• Infesting web pages with tracking code
• Utilizing your web browser for fraudulent clicking
• Providing the attackers with the ability to manage your web browser remotely.

This is an incredible amount of damage from only an add-on for a web browser!

Actions To Take Now​

While Firefox has already removed many malicious add-ons, you still need to take care:

• Verify all installed Firefox add-ons
• Delete all add-ons you do not have faith in
• Be cautious when downloading add-ons for free from companies you do not know.

Conclusion​

GhostPoster attacks demonstrate one thing for certain: you can be exposed to malware by even the smallest of things, like the icons used for add-ons. When installing an add-on for your web browser, look at it closely and perform due diligence prior to clicking on anything to install it. It is much easier to prevent a problem from occurring than to fix it later.