Malware writers spoof Firefox plug-in

The new attack exploits a Firefox browser plug-in

A virulent new attack on Mozilla's Firefox browser is setting off alarms in the security world.

Researchers from BitDefender said that the new attack exploits a browser plug-in. The malware reportedly disguises itself as Greasemonkey, a plug-in which allows users to write and execute custom scripts to add or augment web page data.

Once installed, the malicious code runs every time the browser is loaded. The malware will attempt to seek out stored details for popular banks, and online payment services such as PayPal and eGold. Any captured information is uploaded to a server in Russia.

"Users should be aware of the risks they face if such confidential information is stolen," said Viorel Canja, who heads up BitDefender's anti-virus lab.

A Trojan masquerading as a Firefox plug-in is unusual, but disguising malware as browser and system add-ons is a common social engineering practice.

Many Trojans attempt to lure victims by pretending to be ActiveX files for Internet Explorer. Attackers also commonly use the promise of pornographic or sensational videos to dupe users into downloading malware-laden fake codec files.