Browser Malware
How I Built a Firefox Extension Malware Scanner — And Used It to Expose a Malicious "YouTube Downloader"
Browser extensions sit at the most privileged layer of your web experience — they can read every page you visit, capture every keystroke, and silently exfiltrate your data. In this post, I walk through `extension-scanner.py`, an open-source static analysis tool I built to automatically detect malicious Firefox extensions. Then I put it to the test against a real-world extension that appeared in the wild masquerading as a harmless YouTube downloader — and the results are alarming.