New GhostPoster Attack Leverages PNG Icon to Infect 50,000 Firefox Users

Cybersecuritynews •Tushar Subhra Dutta • December 17, 2025

A sophisticated new malware campaign dubbed “GhostPoster” has been uncovered, leveraging a clever steganography technique to compromise approximately 50,000 Firefox users. The attack vector primarily involves seemingly innocent browser extensions, such as “Free VPN Forever,” which conceal malicious payloads within their own interface icons. Unlike traditional malware that relies on external downloads or obvious script […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GhostPoster Attack Compromises 50,000 Firefox Users via PNG Icons The GhostPoster malware campaign has compromised approximately 50,000 Firefox users by exploiting browser extensions that disguise malicious payloads within PNG icons. This attack utilizes a steganography technique to conceal the malware, making it difficult for users to detect the threat. Affected extensions include seemingly benign applications like 'Free VPN Forever.' 2 sources 27

Extracted Entities

New GhostPoster Attack Leverages PNG Icon to Infect 50,000 Firefox Users

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)