Mozilla warns of active phishing campaign targeting Firefox Add-on developers
Take action: If you're a Firefox extension developer, be aware that you are targeted. Don't click links in emails claiming to be from Mozilla about account updates - these are phishing attempts using fake domains like "mozila" instead of "mozilla". Always navigate directly to addons.mozilla.org or mozilla.org instead of following email links.
Learn More
Mozilla has issued a warning about an active phishing campaign targeting Firefox extension developers with accounts on its official AMO (addons.mozilla.org) repository.
The attackers are impersonating the AMO team via fraudulent emails designed to steal developer credentials and compromise trusted accounts. The phishing emails imply urgency through some variation of the message "Your Mozilla Add-ons account requires an update to continue accessing developer features."
The attackers have been observed using domains that closely mimic legitimate Mozilla domains like the use of the string "mozila" in the domain instead of "mozilla".
The login form links in the email lead to a fake site that will proxy requests to the main catalog addons.mozilla.org.
Mozilla has not disclosed the total number of affected individuals or the full scope of the campaign, at least one developer has confirmed falling victim to the phishing scam.
The primary target of this campaign appears to be:
- Mozilla/AMO developer account credentials
- Authentication tokens and session data
The ultimate goal of these attacks appears to be gaining control over legitimate developer accounts to distribute malicious extensions through Mozilla's trusted platform.
Mozilla strongly recommends that developers do not click any links in suspicious emails, verify that emails were sent by Mozilla-owned domains (firefox.com, mozilla.org, mozilla.com, or their subdomains). Developers should validate that links point to legitimate Mozilla domains before opening them, or preferably navigate directly to mozilla.org or firefox.com rather than following email links.
