New GhostPoster Attack Leverages PNG Icon to Infect 50,000 Firefox Users

GhostPoster is a widespread malware campaign that leverages malicious Firefox extensions to embed and execute hidden JavaScript payloads inside PNG icon files, evading standard scanners. The threat uses a custom decode/decrypt routine (case/digit swap, Base64, XOR by runtime ID), communicates with C2 infrastructure (e.g., liveupdt.com), disables Content-Security-Policy protections, and conducts traffic hijacking and affiliate fraud, with an estimated ~50,000 affected users and at least 17 compromised extensions.